Wireshark-bugs: [Wireshark-bugs] [Bug 9789] New: nas-eps dissector: CS Service notification diss
| Bug ID |
9789
|
| Summary |
nas-eps dissector: CS Service notification dissection stops after Paging identity IE
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
1.10.5
|
| Hardware |
All
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Normal
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
bugzilla-admin@wireshark.org
|
| Reporter |
rspmn@arcor.de
|
Created attachment 12567 [details]
sample CS Service notification message
Build Information:
TShark 1.10.5 (SVN Rev Unknown from unknown)
Copyright 1998-2013 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GLib 2.38.2, with libpcap, with libz 1.2.8, without
POSIX
capabilities, without libnl, without SMI, without c-ares, without ADNS, with
Lua
5.1, without Python, without GnuTLS, without Gcrypt, without Kerberos, without
GeoIP.
Running on Linux 3.11.10-7-default, with locale en_US, with libpcap version
1.3.0, with libz 1.2.8.
Built using gcc 4.8.1 20130909 [gcc-4_8-branchrevision 202388].
--
The nas-eps dissector stops to dissect
NAS EPS Mobility Management Message Type: CS Service notification (0x64)
messages after the Paging identity IE as can be seen from the attached .pcap
(Decode User DLT 2 as nas-eps_plain).
With a suitably modified de_emm_paging_id() which contains return(1) instead
of return(len) the complete message is dissected:
DLT: 149, Payload: nas-eps_plain (Non-Access-Stratum (NAS)PDU)
Non-Access-Stratum (NAS)PDU
0000 .... = Security header type: Plain NAS message, not security protected
(0)
.... 0111 = Protocol discriminator: EPS mobility management messages (0x07)
NAS EPS Mobility Management Message Type: CS Service notification (0x64)
Paging identity
0000 000. = Spare bit(s): 0x00
.... ...1 = Paging identity value: TMSI
Called Party BCD Number - CLI - (490123456789)
Element ID: 0x60
Length: 8
0... .... = Extension: Extended
.001 .... = Type of number: International Number (0x01)
.... 0001 = Numbering plan identification: ISDN/Telephony Numbering
(ITU-T Rec. E.164 / ITU-T Rec. E.163) (0x01)
1... .... = Extension: No Extension
.00. .... = Presentation indicator: Presentation allowed (0x00)
...0 00.. = Spare bit(s): 0
.... ..01 = Screening indicator: User-provided, verified and passed
(0x01)
BCD Digits: 490123456789
>From my interpretation of section 9.9.3.38 of TS 24.301 however the CLI
IE contains the calling party BCD number instead of the called party BCD
number as displayed by tshark.
Regards,
Reinhard
You are receiving this mail because:
- You are watching all bug changes.
