Wireshark-users: Re: [Wireshark-users] why there is a malformed?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Pascal Quantin <pascal.quantin@xxxxxxxxx>
Date: Sun, 23 Feb 2014 20:24:42 +0100
2014-02-23 9:26 GMT+01:00 damker <damker@xxxxxxxx>:

the attachment file is a sample file for lte rrc message(pls set user_dlt 147 as lte-rrc.ul.dcch ), there is a malformed error,
as shown below, is the red mark should be decoded as "ultraTDD128"?

Hi,

the packet is malformed and Wireshark decoding correct:
- the UE Capability RAT container has a size of only 12 bytes and the interRAT parameters IE already reaches the last byte of the container
- the interRAT-Parameters IE indicates that only utraFDD optional IE is present
You can check it yourself by activating the PER internal debug output by ticking Preferences -> Protocols -> PER -> "Display the internal PER fields in the tree".
I also checked the encoding of the UE EUTRA Capability IE and it also complains about a size too short.

Best regards,
Pascal.