Hi, There is decoding NAS 5GS - NAS message container, if EPS NAS message container is also present inside NAS 5GS PDU. Attached pcap. >From my analysis it looks that NAS message container is taking Security Header >type field from previously decoded EPS NAS message instead of taking it from >NAS 5GS PDU.
This change fixed the issue:
diff --git a/epan/dissectors/packet-nas_5gs.c b/epan/dissectors/packet-nas_5gs.c
index 2e2a61ae94..7af040b4a0 100644
--- a/epan/dissectors/packet-nas_5gs.c
+++ b/epan/dissectors/packet-nas_5gs.c
@@ -2574,6 +2574,7 @@ de_nas_5gs_mm_eps_nas_msg_cont(tvbuff_t *tvb, proto_tree
*tree, packet_info *pin
col_set_fence(pinfo->cinfo, COL_PROTOCOL);
call_dissector(nas_eps_handle, tvb_new_subset_length(tvb, offset,
len), pinfo, tree);
}
+ (pinfo->curr_layer_num)--;
return len;
}
Can you please let me know if indeed this is a bug and if my change is a valid
fix?
Thanks,
Dragos
nas-2.pcapng
Description: nas-2.pcapng
_______________________________________________ Wireshark-dev mailing list -- [email protected] To unsubscribe send an email to [email protected]
