Wireshark-bugs: [Wireshark-bugs] [Bug 8208] New: Wrong parcing of ULI of gtpv2 messages - errors
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 14 Jan 2013 10:12:59 +0000
Bug ID 8208
Summary Wrong parcing of ULI of gtpv2 messages - errors in SAC, RAC & ECI
Classification Unclassified
Product Wireshark
Version 1.8.4
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Major
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter gremlin_sc@mail.ru 

Created attachment 9804 [details]
pcap which was used

Build Information:
Version 1.8.4 (SVN Rev 46250 from /trunk-1.8)
--
Open attached pcap with Wireshark
- filter gtpv2 messages:
gtpv2
- Find a first(frame 3) Create Session Request -> tick ULI

You could see that ULI string has following value (in HEX):
56 00 22 00 1f 72 12 00 00 78 00 00 72 12 00 00 78 00 64 72 12 00 00 78 00 0f
72 12 00 00 57 72 12 00 00 00 1d e6

4 bugs are described below (based on ULI, section 8.21 3GPP TS 29.274):
56 00 22 00 - header (IE Type, Lenth, etc); correct
1f - presence flags; correct
72 12 00 00 78 00 00 - CGI part, where 72 12 00 - MCC+MNC, 0078 - LAC, 0000 -
Cell Identity; values are correct, but CGI bits are marked incorrectly when
chosen (12000078000072) - that error also repeats for all bits after
(SAI,RAI,TAI,ECGI).
72 12 00 00 78 00 64 - SAI part, where 72 12 00 - MCC+MNC, 0078 - LAC, 0064 -
SAC (120 visible in WS); SAC is Wrong - SAC should be 100 in Dec (instead of
120 which is reported), marked bits are also incorrect.
72 12 00 00 78 00 0f - RAI part, where 72 12 00 - MCC+MNC, 0078 - LAC, 000f -
RAC (120 visible in WS); RAC is Wrong - RAC should be 15 in Dec (instead of 120
which is reported), marked bits are also incorrect.
72 12 00 00 57 - TAI part, where 72 12 00 - MCC+MNC, 0057 - TAC; correct
72 12 00 00 00 1d e6 - ECGI part, where 72 12 00 - MCC+MNC, 0 - Spare, 0001de6
- ECI (00001de6 visible in WS); ECI is Wrong - 1: should be converted to DEC
(7654), 2: consists of 28 bits (0001de6) instead of 32(00001de6).

You are receiving this mail because:
  • You are watching all bug changes.