Stream Control Transmission Protocol DATA chunk(ordered, complete segment, TSN: 1069095858, SID: 10, SSN: 29055, PPID:

3, payload length: 244 bytes) Chunk type: DATA (0) 0... .... = Bit: Stop processing of the packet .0.. .... = Bit: Do not report Chunk flags: 0x03 .... ...1 = E-Bit: Last segment .... ..1. = B-Bit: First segment .... .0.. = U-Bit: Ordered delivery .... 0... = I-Bit: Possibly delay SACK Chunk length: 260 TSN: 1069095858 Stream Identifier: 0x000a Stream sequence number: 29055 Payload protocol identifier: M3UA (3) MTP 3 User Adaptation Layer Version: Release 1 (1) Reserved: 0x00 Message class: Transfer messages (1) Message type: Payload data (DATA) (1) Message length: 244 Protocol data (SS7 message of 219 bytes) Parameter Tag: Protocol data (528) Parameter length: 235 OPC: 2101 DPC: 700 SI: SCCP (3) NI: 2 MP: 0 SLS: 9 [MTP3 equivalents] [OPC: 2101] [DPC: 700] [PC: 2101] [PC: 700] [NI: 2] [SLS: 9] Padding: 00 Signalling Connection Control Part Message Type: Unitdata (0x09) .... 0001 = Class: 0x01 1000 .... = Message handling: Return message on error (0x08) Pointer to first Mandatory Variable parameter: 3 Pointer to second Mandatory Variable parameter: 13 Pointer to third Mandatory Variable parameter: 23 Called Party address (10 bytes) Address Indicator .1.. .... = Routing Indicator: Route on SSN (0x01) ..01 00.. = Global Title Indicator: Translation Type, Numbering Plan , Encoding Scheme, and Nature of Address Indicator included (0x04) .... ..1. = SubSystem Number Indicator: SSN present (0x01) .... ...0 = Point Code Indicator: Point Code not present (0x00) SubSystem Number: MSC (Mobile Switching Center) (8) [Linked to TCAP] Global Title 0x4 (8 bytes) Translation Type: 0x00 0001 .... = Numbering Plan: ISDN/telephony (0x01) .... 0010 = Encoding Scheme: BCD, even number of digits (0x02)

.000 0100 = Nature of Address Indicator: International number (0x04) Address information (digits): 5038199917 Country Code: 503 El Salvador (length 3) Calling Party address (10 bytes) Address Indicator .0.. .... = Routing Indicator: Route on GT (0x00) ..01 00.. = Global Title Indicator: Translation Type, Numbering Plan , Encoding Scheme, and Nature of Address Indicator included (0x04) .... ..1. = SubSystem Number Indicator: SSN present (0x01) .... ...0 = Point Code Indicator: Point Code not present (0x00) SubSystem Number: HLR (Home Location Register) (6) [Linked to TCAP] Global Title 0x4 (8 bytes) Translation Type: 0x00 0001 .... = Numbering Plan: ISDN/telephony (0x01) .... 0010 = Encoding Scheme: BCD, even number of digits (0x02) .000 0100 = Nature of Address Indicator: International number (0x04) Address information (digits): 5038199901 Country Code: 503 El Salvador (length 3) Transaction Capabilities Application Part end Destination Transaction ID Transaction Id: 610001b5 oid: 0.0.17.773.1.1.1 (id-as-dialogue) dialogueResponse Padding: 7 protocol-version: 80 (version1) 1... .... = version1: True application-context-name: 0.4.0.0.1.0.5.3 (locationInfoRetrievalCont ext-v3) result: accepted (0) result-source-diagnostic: dialogue-service-user (1) dialogue-service-user: null (0) components: 1 item Component: returnResultLast (2) returnResultLast invokeID: 1 resultretres opCode: localValue (0) localValue: 22 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 121 Parameter (0x09) Tag: 0x09 Length: 8 Data: 07 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 52 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 12 Parameter (0x05) Tag: 0x05 Length: 7 Data: 91

Parameter (0x06) Tag: 0x06 Length: 1 Data: 20 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 34 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 30 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 23 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 19 Parameter (0x0a) Tag: 0x0a Length: 1 Data: 02 Parameter (0x02) Tag: 0x02 Length: 2 Data: 01 Parameter (0x00) Tag: 0x00 Length: 7 Data: 91 Parameter (0x01) Tag: 0x01 Length: 1 Data: 01 CONSTRUCTOR EOC Parameter (0x00) Tag: 0x00 Length: 1 Data: 01 CONSTRUCTOR EOC CONSTRUCTOR EOC CONSTRUCTOR EOC CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 3 Parameter (0x03) Tag: 0x03 Length: 1 Data: 11 Parameter (0x02) Tag: 0x02 Length: 6 Data: 91 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 36

CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 34 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 32 Parameter (0x06) Tag: 0x06 Length: 9 Data: 2a CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 19 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 6 Parameter (0x01) Tag: 0x01 Length: 1 Data: 02 Parameter (0x05) Tag: 0x05 Length: 1 Data: 02 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 9 Parameter (0x01) Tag: 0x01 Length: 1 Data: 0a CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 4 Parameter (0x02) Tag: 0x02 Length: 2 Data: 19 Parameter (0x0f) Tag: 0x0f Length: 2 Data: 04 CONSTRUCTOR EOC GSM Mobile Application Component: returnResultLast (2) returnResultLast invokeID: 1 resultretres opCode: localValue (0) localValue: sendRoutingInfo (22) imsi: 07060400536271f3 TBCD digits: 706040003526173 extendedRoutingInfo: camelRoutingInfo (1) camelRoutingInfo

forwardingData forwardedToNumber: 910573079199f5 1... .... = Extension: No Extension .001 .... = Nature of number: International Numb er (0x01) .... 0001 = Number plan: ISDN/Telephony Numberin g (Rec ITU-T E.164) (0x01) Address digits: 50377019995 Country Code: 503 El Salvador (length 3) forwardingOptions: 20 0... .... = Notification to forwarding party: No not ification .0.. .... = Redirecting presentation: No presentatio nn ..1. .... = Notification to calling party: Notificat ion .... 00.. = Forwarding reason: ms not reachable (0x0 0) gmscCamelSubscriptionInfo o-CSI o-BcsmCamelTDPDataList: 1 item O-BcsmCamelTDPData o-BcsmTriggerDetectionPoint: collectedIn fo (2) serviceKey: 313 gsmSCF-Address: 91255521326507 1... .... = Extension: No Extension .001 .... = Nature of number: Intern ational Number (0x01) .... 0001 = Number plan: ISDN/Teleph ony Numbering (Rec ITU-T E.164) (0x01) Address digits: 525512235670 Country Code: 52 Mexico (length 2) defaultCallHandling: releaseCall (1) camelCapabilityHandling: 1 basicService: ext-Teleservice (3) ext-Teleservice: telephony (17) vmsc-Address: 910583919971 1... .... = Extension: No Extension .001 .... = Nature of number: International Number (0x01) .... 0001 = Number plan: ISDN/Telephony Numbering (Rec ITU-T E.164) (0x01) Address digits: 5038199917 Country Code: 503 El Salvador (length 3) extensionContainer privateExtensionList: 1 item PrivateExtension extId: 1.2.826.0.1249.58.1.0 (ericsson-gsm-Map-Ext) Extension Data BER: Dissector for OID:1.2.826.0.1249.58.1.0 not imp lemented. Contact Wireshark developers if you want this supported [Expert Info (Warn/Undecoded): BER: Dissector fo r OID 1.2.826.0.1249.58.1.0 not implemented] [Message: BER: Dissector for OID 1.2.826.0.1 249.58.1.0 not implemented] [Severity level: Warn] [Group: Undecoded] Padding: 4 supportedCamelPhasesInVMSC: 80 (phase1) 1... .... = phase1: True

.0.. .... = phase2: False ..0. .... = phase3: False ...0 .... = phase4: False Stream Control Transmission Protocol DATA chunk(ordered, complete segment, TSN: 1069095859, SID: 10, SSN: 29056, PPID: 3, payload length: 164 bytes) Chunk type: DATA (0) 0... .... = Bit: Stop processing of the packet .0.. .... = Bit: Do not report Chunk flags: 0x03 .... ...1 = E-Bit: Last segment .... ..1. = B-Bit: First segment .... .0.. = U-Bit: Ordered delivery .... 0... = I-Bit: Possibly delay SACK Chunk length: 180 TSN: 1069095859 Stream Identifier: 0x000a Stream sequence number: 29056 Payload protocol identifier: M3UA (3) MTP 3 User Adaptation Layer Version: Release 1 (1) Reserved: 0x00 Message class: Transfer messages (1) Message type: Payload data (DATA) (1) Message length: 164 Protocol data (SS7 message of 138 bytes) Parameter Tag: Protocol data (528) Parameter length: 154 OPC: 2101 DPC: 700 SI: SCCP (3) NI: 2 MP: 0 SLS: 9 [MTP3 equivalents] [OPC: 2101] [DPC: 700] [PC: 2101] [PC: 700] [NI: 2] [SLS: 9] Padding: 0000 Signalling Connection Control Part Message Type: Unitdata (0x09) .... 0000 = Class: 0x00 1000 .... = Message handling: Return message on error (0x08) Pointer to first Mandatory Variable parameter: 3 Pointer to second Mandatory Variable parameter: 13 Pointer to third Mandatory Variable parameter: 23 Called Party address (10 bytes) Address Indicator .1.. .... = Routing Indicator: Route on SSN (0x01) ..01 00.. = Global Title Indicator: Translation Type, Numbering Plan , Encoding Scheme, and Nature of Address Indicator included (0x04) .... ..1. = SubSystem Number Indicator: SSN present (0x01) .... ...0 = Point Code Indicator: Point Code not present (0x00) SubSystem Number: VLR (Visitor Location Register) (7) [Linked to TCAP] Global Title 0x4 (8 bytes) Translation Type: 0x00

0001 .... = Numbering Plan: ISDN/telephony (0x01) .... 0010 = Encoding Scheme: BCD, even number of digits (0x02) .000 0100 = Nature of Address Indicator: International number (0x04) Address information (digits): 5038199917 Country Code: 503 El Salvador (length 3) Calling Party address (10 bytes) Address Indicator .0.. .... = Routing Indicator: Route on GT (0x00) ..01 00.. = Global Title Indicator: Translation Type, Numbering Plan , Encoding Scheme, and Nature of Address Indicator included (0x04) .... ..1. = SubSystem Number Indicator: SSN present (0x01) .... ...0 = Point Code Indicator: Point Code not present (0x00) SubSystem Number: HLR (Home Location Register) (6) [Linked to TCAP] Global Title 0x4 (8 bytes) Translation Type: 0x00 0001 .... = Numbering Plan: ISDN/telephony (0x01) .... 0010 = Encoding Scheme: BCD, even number of digits (0x02) .000 0100 = Nature of Address Indicator: International number (0x04) Address information (digits): 5038199901 Country Code: 503 El Salvador (length 3) Transaction Capabilities Application Part end Destination Transaction ID Transaction Id: b60000ba oid: 0.0.17.773.1.1.1 (id-as-dialogue) dialogueResponse Padding: 7 protocol-version: 80 (version1) 1... .... = version1: True application-context-name: 0.4.0.0.1.0.14.3 (infoRetrievalContext-v3) result: accepted (0) result-source-diagnostic: dialogue-service-user (1) dialogue-service-user: null (0) components: 1 item Component: returnResultLast (2) returnResultLast invokeID: 1 resultretres opCode: localValue (0) localValue: 56 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 42 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 38 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 34 Parameter (0x04) Tag: 0x04 Length: 16 Data: e2 Parameter (0x04) Tag: 0x04 Length: 4

Data: 53 Parameter (0x04) Tag: 0x04 Length: 8 Data: 91 CONSTRUCTOR EOC CONSTRUCTOR EOC GSM Mobile Application Component: returnResultLast (2) returnResultLast invokeID: 1 resultretres opCode: localValue (0) localValue: sendAuthenticationInfo (56) authenticationSetList: tripletList (0) tripletList: 1 item AuthenticationTriplet rand: e2e6b0bcc1613a16f00b0fc7b6bdb2a6 sres: 53dce737 kc: 91ad586a87ea4400 Stream Control Transmission Protocol DATA chunk(ordered, complete segment, TSN: 1069095860, SID: 13, SSN: 19460, PPID: 3, payload length: 156 bytes) Chunk type: DATA (0) 0... .... = Bit: Stop processing of the packet .0.. .... = Bit: Do not report Chunk flags: 0x03 .... ...1 = E-Bit: Last segment .... ..1. = B-Bit: First segment .... .0.. = U-Bit: Ordered delivery .... 0... = I-Bit: Possibly delay SACK Chunk length: 172 TSN: 1069095860 Stream Identifier: 0x000d Stream sequence number: 19460 Payload protocol identifier: M3UA (3) MTP 3 User Adaptation Layer Version: Release 1 (1) Reserved: 0x00 Message class: Transfer messages (1) Message type: Payload data (DATA) (1) Message length: 156 Protocol data (SS7 message of 129 bytes) Parameter Tag: Protocol data (528) Parameter length: 145 OPC: 2101 DPC: 700 SI: SCCP (3) NI: 2 MP: 0 SLS: 12 [MTP3 equivalents] [OPC: 2101] [DPC: 700] [PC: 2101] [PC: 700] [NI: 2] [SLS: 12] Padding: 000000 Signalling Connection Control Part

Message Type: Unitdata (0x09) .... 0000 = Class: 0x00 1000 .... = Message handling: Return message on error (0x08) Pointer to first Mandatory Variable parameter: 3 Pointer to second Mandatory Variable parameter: 13 Pointer to third Mandatory Variable parameter: 23 Called Party address (10 bytes) Address Indicator .1.. .... = Routing Indicator: Route on SSN (0x01) ..01 00.. = Global Title Indicator: Translation Type, Numbering Plan , Encoding Scheme, and Nature of Address Indicator included (0x04) .... ..1. = SubSystem Number Indicator: SSN present (0x01) .... ...0 = Point Code Indicator: Point Code not present (0x00) SubSystem Number: VLR (Visitor Location Register) (7) [Linked to TCAP] Global Title 0x4 (8 bytes) Translation Type: 0x00 0001 .... = Numbering Plan: ISDN/telephony (0x01) .... 0010 = Encoding Scheme: BCD, even number of digits (0x02) .000 0100 = Nature of Address Indicator: International number (0x04) Address information (digits): 5038199917 Country Code: 503 El Salvador (length 3) Calling Party address (10 bytes) Address Indicator .0.. .... = Routing Indicator: Route on GT (0x00) ..01 00.. = Global Title Indicator: Translation Type, Numbering Plan , Encoding Scheme, and Nature of Address Indicator included (0x04) .... ..1. = SubSystem Number Indicator: SSN present (0x01) .... ...0 = Point Code Indicator: Point Code not present (0x00) SubSystem Number: HLR (Home Location Register) (6) [Linked to TCAP] Global Title 0x4 (8 bytes) Translation Type: 0x00 0001 .... = Numbering Plan: ISDN/telephony (0x01) .... 0010 = Encoding Scheme: BCD, even number of digits (0x02) .000 0100 = Nature of Address Indicator: International number (0x04) Address information (digits): 5038199901 Country Code: 503 El Salvador (length 3) Transaction Capabilities Application Part begin Source Transaction ID Transaction Id: 99000100 oid: 0.0.17.773.1.1.1 (id-as-dialogue) dialogueRequest Padding: 7 protocol-version: 80 (version1) 1... .... = version1: True application-context-name: 0.4.0.0.1.0.3.3 (roamingNumberEnquiryConte xt-v3) components: 1 item Component: invoke (1) invoke invokeID: 1 opCode: localValue (0) localValue: 4 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x00 Length: 47 Parameter (0x00)

Tag: 0x00 Length: 8 Data: 07 Parameter (0x01) Tag: 0x01 Length: 6 Data: 91 CONSTRUCTOR CONSTRUCTOR Tag Tag: 0x02 Length: 8 Parameter (0x0a) Tag: 0x0a Length: 1 Data: 01 Parameter (0x04) Tag: 0x04 Length: 3 Data: 04 Parameter (0x08) Tag: 0x08 Length: 6 Data: 91 Parameter (0x09) Tag: 0x09 Length: 5 Data: 0f Parameter (0x0f) Tag: 0x0f Length: 2 Data: 05 GSM Mobile Application Component: invoke (1) invoke invokeID: 1 opCode: localValue (0) localValue: provideRoamingNumber (4) imsi: 07060400932325f2 TBCD digits: 706040003932522 msc-Number: 910583919971 1... .... = Extension: No Extension .001 .... = Nature of number: International Number (0x01) .... 0001 = Number plan: ISDN/Telephony Numbering (Rec ITU-T E.1 64) (0x01) Address digits: 5038199917 Country Code: 503 El Salvador (length 3) gsm-BearerCapability protocolId: gsm-0408 (1) signalInfo: 0401a0 Tag: Bearer Capability (4) Length: 1 Octet 3 1... .... = Extension: No Extension .01. .... = Radio channel requirement: Full rate support only MS/fullrate speech version 1 supported ...0 .... = Coding standard: GSM standardized coding .... 0... = Transfer mode: circuit .... .000 = Information transfer capability: Speech (0x0 0) gmsc-Address: 910583919971

1... .... = Extension: No Extension .001 .... = Nature of number: International Number (0x01) .... 0001 = Number plan: ISDN/Telephony Numbering (Rec ITU-T E.1 64) (0x01) Address digits: 5038199917 Country Code: 503 El Salvador (length 3) callReferenceNumber: 0f694c0002 Padding: 5 supportedCamelPhasesInInterrogatingNode: c0 (phase1, phase2) 1... .... = phase1: True .1.. .... = phase2: True ..0. .... = phase3: False ...0 .... = phase4: False