Wireshark · Ethereal-users: [Ethereal-users] Using the asn1 plugin to decode an arbitrary protocol

["Bob Bowman" <bob.bowman1@xxxxxxxxxxxxxxxxxxxxxxx>]

Hello,

 

I am trying to use Ethereal to decode packets that contain ASN.1 encoded PDUs for protocols that are not supported by Ethereal (e.g. CALEA J-STD-25).  To that end, I have created ASN.1 type tables from the ASN.1 definitions for these protocols and configured the asn1 plugin to point to them.  However, I have not had much luck in successfully decoding packets containing ASN.1-encoded PDUs.  Ethereal recognizes the packets as being ASN.1-encoded, but does not properly decode the protocol defined in the type table.  Below is a snippet of the ethereal.log file records for the beginning of the first packet encountered. 

 

Can someone point me in the right direction?

 

dissect_asn1: udp

PDUreset 1-0

==off=0 U0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  return 'explicit-EOC', ignore

PDUreset 1-1

==off=0 U0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  return 'explicit-EOC', ignore

==off=2 X0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  EOI, pos.node == 0

PDUreset 1-2

==off=2 U0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  return 'explicit-EOC', ignore

==off=4 X0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  EOI, pos.node == 0

PDUreset 1-3

==off=4 U0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  return 'explicit-EOC', ignore

==off=6 X0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  EOI, pos.node == 0

PDUreset 1-4

==off=6 U0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  return 'explicit-EOC', ignore

==off=8 X0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  EOI, pos.node == 0

PDUreset 1-5

==off=8 U0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  return 'explicit-EOC', ignore

==off=10 X0p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

  EOI, pos.node == 0

PDUreset 1-6

==off=10 U16p sp=1,pos=02251A88,tbl-choice[repeat]:SCF-information-object,0

    repeating choice

    choice [push], U0, SCF-information-object

    have U16, found C1, swn-scf-header

    have U16, found C2, swn-scf-ama

    have U16, found C3, swn-scf-trailer

    have U16, found C4, mpc-scf-exception

    have U16, found C5, msi-scf-normalized

    have U16, found C6, msi-scf-raw

    ...no matching choice...

    'SCF-information-object' U0 will be used

  candidate tbl-choice 'SCF-information-object', U0

  using: tbl-choice 'SCF-information-object', U0

  return [tbl-choice] 'SCF-information-object' vid=24064, tid=-1

 

Thanks,

--
Bob Bowman
Openwave Systems Inc.
Mobile: +1 (201) 310-1812
Yahoo IM: op_bob_bowman

Privacy and Confidentiality Notice: The information contained in this electronic mail message is intended for the named recipient(s) only.  It may contain privileged and confidential information.  If you are not an intended recipient, you must not copy, forward, distribute or take any action in reliance on it.  If you have received this electronic email message in error, please notify the sender immediately.