Wireshark · Wireshark-users: Re: [Wireshark-users] Diameter [Malformed Packet: GTPv2]

[Anders Broman <a.broman@xxxxxxxxxxxx>]

Bo Xu skrev 2011-08-25 18:21:

Hello  guys ,

         I am very confused that I got "Malformed Packet: GTPv2" in every Diameter (CCR) in version 1.6 . 

   I tried multiple versions of wireshark , I have found that  for the same err_sample.pcap which I have already attached , there is

   no such annoying prompt in version 1.2.16 .   I read the WireShark manual , there is some explanation in this URL.

   http://www.wireshark.org/docs/wsug_html_chunked/AppMessages.html#id622336 . 

   To my understanding , mostly there is something wrong in the packet content . Another proof is that other diameter packet is working

   perfectly with wireshark 1.6.1 version .

   Here comes my question :    does this   AVP(20600)  finally caused the "malformed packet" prompt because there is no data in this AVP?

   Or is there anything wrong with the CCR packet content ? 

   FYI : Diameter Server Port is 6555 ,  and this server connects the multiple clients.

     Service-Information: 00005078c000000c00013c680000036ac000001c000028af...
            AVP: Unknown(20600) l=12 f=VM- vnd=81000
                AVP Code: 20600 Unknown
                AVP Flags: 0xc0
                AVP Length: 12
                AVP Vendor Id: Unknown (81000)
                [No data]
                    [Expert Info (Warn/Undecoded): Data is empty]
                        [Message: Data is empty]
                        [Severity level: Warn]
                        [Group: Undecoded]
            AVP: PS-Information(874) l=28 f=VM- vnd=TGPP
[Malformed Packet: GTPv2]
    [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]
        [Message: Malformed Packet (Exception occurred)]
        [Severity level: Error]
        [Group: Malformed]

BR
Xu Bo

Hi,
Some background, Wireshark dissects Diameter AVP with the help of xml files they can be found in the
diameter directorry. For some AVP:s there is also C code to further dissect "Octet Strings" packet-diameter_3gpp.c.

AVP 20600 with vendor id 81000 is not known to Wireshark, BTW the vendor id should be registered in which case Wireshark would show the vendor. There is no problem with the dissection of this AVP as far as I can tell.
AVP 22 vendor 3GPP "3GPP-User-Location-Info" is specified as Octet String and
/*
 * TS 29.061 v9.2.0
 * 16.4.7.2 Coding 3GPP Vendor-Specific RADIUS attributes
 *
 * For P-GW, the Geographic Location Type values and coding are defined as follows:
 *
 * 0        CGI
 * 1        SAI
 * 2        RAI
 * 3-127    Spare for future use
 * 128      TAI
 * 129      ECGI
 * 130      TAI and ECGI
 * 131-255  Spare for future use
 */
This dissection fails as the content seems no to be correct according to the spec.

Best regards
Anders

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe