Just jotting this down as a quick note, as I had some problems getting Wireshark (not it’s fault) to decode a SIGTRAN trace I was working on.
Normally you have to configure TCAP to know what Subsystem Numbers [SSN] to handle on the SCCP layer e.g. 7 for VLR, 8 for MSC, etc. and this is done under Edit -> Preferences -> Protocols -> TCAP
Unfortunately my trace had a bug – there was no SSN in the response message so Wireshark was only decoding up to the SCCP layer.
You can handle this case by instructing SCCP to decode as TCAP by default.
