https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5243
Summary: [NAS EPS] Traffic Flow Template IE dissection bugs
Product: Wireshark
Version: SVN
Platform: Other
OS/Version: Windows XP
Status: NEW
Severity: Major
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: pascal.quantin@xxxxxxxxx
Created an attachment (id=5189)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5189)
TFT IE dissection fixes
Build Information:
Version 1.5.0 (SVN Rev 34176 from /trunk)
Copyright 1998-2010 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.16.6, (32-bit) with GLib 2.22.4, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Sep
16 2010), with AirPcap.
Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.2
(packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.
Built using Microsoft Visual C++ 9.0 build 30729
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
When dissecting a EPS Bearer Resource Allocation Request message including a
Traffic Flow Template IE, Wireshark does not handle the presence of several
packet filter components in a given packet filter. Moreover the disssection of
several packet filter components is buggy.
The current message dump:
27 d1 6b 8e 18 01 02 02 d4 05 19 21 20 00 15 10 0b 09 00 36 ff ff ff ff 30 01
41 04 00 ff ff 51 27 10 27 12 05 09 00 00 00 00
Is decoded as:
Non-Access-Stratum (NAS)PDU
0010 .... = Security header type: Integrity protected and ciphered (2)
.... 0111 = Protocol discriminator: EPS mobility management messages (7)
Message authentication code: 0xd16b8e18
Sequence number: 1
0000 .... = EPS bearer identity: 0x00
.... 0010 = Protocol discriminator: EPS session management messages (2)
Procedure transaction identity: 2
NAS EPS session management messages: Bearer resource allocation request
(0xd4)
0000 .... = Spare half octet: 0
.... 0101 = Linked EPS bearer identity: EPS bearer identity value 5 (5)
Traffic Flow Template - Traffic flow aggregate
Length: 25
001. .... = TFT operation code: Create new TFT (1)
...0 .... = E bit: Parameters list is not included
.... 0001 = Number of packet filters: 1
Packet filter 0
0010 .... = Packet filter direction: Uplink only (2)
.... 0000 = Packet filter identifier: 0
Packet evaluation precedence: 0x00 (0)
Packet filter length: 0x15 (21)
Packet filter component type identifier: IPv4 remote address type
(16)
IPv4 adress: 11.9.0.54 (11.9.0.54)
IPv4 address mask: 255.255.255.255 (255.255.255.255)
EPS quality of service - Required traffic flow QoS
Length: 5
Quality of Service Class Identifier (QCI): QCI 9 (9)
UE->NW Subscribed maximum bit rate for uplink/ NW->UE Reserved
UE->NW Subscribed maximum bit rate for downlink/ NW->UE Reserved
Guaranteed bit rate for uplink : 0 kbps
Guaranteed bit rate for downlink : 0 kbps
After applying the patch attached to this bug, you get the correct decoding:
Non-Access-Stratum (NAS)PDU
0010 .... = Security header type: Integrity protected and ciphered (2)
.... 0111 = Protocol discriminator: EPS mobility management messages (7)
Message authentication code: 0xd16b8e18
Sequence number: 1
0000 .... = EPS bearer identity: 0x00
.... 0010 = Protocol discriminator: EPS session management messages (2)
Procedure transaction identity: 2
NAS EPS session management messages: Bearer resource allocation request
(0xd4)
0000 .... = Spare half octet: 0
.... 0101 = Linked EPS bearer identity: EPS bearer identity value 5 (5)
Traffic Flow Template - Traffic flow aggregate
Length: 25
001. .... = TFT operation code: Create new TFT (1)
...0 .... = E bit: Parameters list is not included
.... 0001 = Number of packet filters: 1
Packet filter 0
0010 .... = Packet filter direction: Uplink only (2)
.... 0000 = Packet filter identifier: 0
Packet evaluation precedence: 0x00 (0)
Packet filter length: 0x15 (21)
Packet filter component type identifier: IPv4 remote address type
(16)
IPv4 adress: 11.9.0.54 (11.9.0.54)
IPv4 address mask: 255.255.255.255 (255.255.255.255)
Packet filter component type identifier: Protocol identifier/Next
header type (48)
Protocol/header: 0x01
Packet filter component type identifier: Local port range type (65)
Low limit port: 1024
High limit port: 65535
Packet filter component type identifier: Remote port range type
(81)
Low limit port: 10000
High limit port: 10002
EPS quality of service - Required traffic flow QoS
Length: 5
Quality of Service Class Identifier (QCI): QCI 9 (9)
UE->NW Subscribed maximum bit rate for uplink/ NW->UE Reserved
UE->NW Subscribed maximum bit rate for downlink/ NW->UE Reserved
Guaranteed bit rate for uplink : 0 kbps
Guaranteed bit rate for downlink : 0 kbps
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
