https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15756
Bug ID: 15756
Summary: Transparent container not decoded in GTPv2-C SRVCC PS
to CS Request Message
Product: Wireshark
Version: 3.0.1
Hardware: x86
OS: Windows 10
Status: UNCONFIRMED
Severity: Enhancement
Priority: Low
Component: Dissection engine (libwireshark)
Assignee: bugzilla-ad...@wireshark.org
Reporter: geoffreyh...@sympatico.ca
Target Milestone: ---
Created attachment 17107
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=17107&action=edit
Sample capture showing Transparent Container in S1AP and GTPv2-C
Build Information:
Version 3.0.1 (v3.0.1-0-gea351cd8)
Copyright 1998-2019 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software;
see the source for copying conditions. There is NO warranty; not even for
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.12.1, with WinPcap SDK (WpdPack) 4.1.2, with GLib
2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4,
with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos,
with MaxMind DB resolver, with nghttp2 1.14.0, with LZ4, with Snappy, with
libxml2 2.9.9, with QtMultimedia, with AirPcap, with SBC, with SpanDSP, with
bcg729.
Running on 64-bit Windows 10 (1803), build 17134, with Intel(R) Core(TM)
i7-7820HQ CPU @ 2.90GHz (with SSE4.2), with 32687 MB of physical memory, with
locale English_Canada.1252, with libpcap version 1.9.0 (packet.dll version
0.992), with GnuTLS 3.6.3, with Gcrypt 1.8.3, without AirPcap, binary plugins
supported (14 loaded). Built using Microsoft Visual Studio 2017 (VC++ 14.12,
build 25835).
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
During an SRVCC from a cellular LTE(4G)->UMTS(3G) network, there is a
transparent container passed over S1AP by the cell site in LTE, and it is
carried through the wireless core over GTPv2-C. In the S1AP message, the
contents of this container are decoded in Wireshark, but in the GTPv2 message,
the hex payload (which is identical) is displayed, but not decoded.
In the attached sample (Srvcc_TransparentContainer_Anon.pcapng), in pkt 1 you
see the Transparent Container passed and fully decoded. In pkt 2, you see the
same Transparent Container being carried over GTP, but this time it is not
decoded
In S1AP:
Item 6: id-Source-ToTarget-TransparentContainer
ProtocolIE-Field
id: id-Source-ToTarget-TransparentContainer (104)
criticality: reject (0)
value
Source-ToTarget-TransparentContainer:
00a066032200005c05450aa0d4a8550d4128089000300029…
SourceRNC-ToTargetRNC-TransparentContainer
rRC-Container:
032200005c05450aa0d4a8550d4128089000300029242148…
numberOfIuInstances: 1
relocationType: ue-involved (1)
targetCellId: 230920843
iE-Extensions: 1 item
Item 0
ProtocolExtensionField
id: id-UE-History-Information (200)
criticality: ignore (1)
extensionValue
UE-History-Information:
0080010101845a417100001b000000a840020220
UE-HistoryInformation: 1 item
Item 0
LastVisitedCell-Item: e-UTRAN-Cell
(0)
e-UTRAN-Cell
global-Cell-ID
cellType
time-UE-StayedInCell: 27s
iE-Extensions: 1 item
In GTPv2:
Source to Target Transparent Container :
IE Type: Source to Target Transparent Container (52)
IE Length: 138
0000 .... = CR flag: 0
.... 0000 = Instance: 0
Length of the Transparent Container: 137
Transparent Container: 00a066032200005c05450aa0d4a8550d4128089000300029…
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
