https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5371
Summary: [NAS EPS] Display explicitly the spare bits when
decoding a TFT
Product: Wireshark
Version: 1.5.x (Experimental)
Platform: Other
OS/Version: All
Status: NEW
Severity: Enhancement
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: pascal.quantin@xxxxxxxxx
Pascal Quantin <pascal.quantin@xxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #5426| |review_for_checkin?
Flag| |
Created an attachment (id=5426)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5426)
Display the spare bits value when dissecting TFT
Build Information:
Version 1.5.0 (SVN Rev 34772 from /trunk)
Copyright 1998-2010 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.12.12, with GLib 2.16.6, with libpcap 1.0.0, with
libz 1.2.3.3, without POSIX capabilities, without libpcre, without SMI, without
c-ares, without ADNS, without Lua, without Python, with GnuTLS 2.4.2, with
Gcrypt 1.4.1, with MIT Kerberos, without GeoIP, without PortAudio, without
AirPcap.
Running on Linux 2.6.26-2-686-bigmem, with libpcap version 1.0.0, with libz
1.2.3.3, GnuTLS 2.4.2, Gcrypt 1.4.1.
Built using gcc 4.3.2.
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
The attached patch allows to display explicitly the spare bits value in the
Traffic Flow Template IE. It allows to detect an encoding problem.
Here is an example of the decoding once the patch is applied:
Non-Access-Stratum (NAS)PDU
0010 .... = Security header type: Integrity protected and ciphered (2)
.... 0111 = Protocol discriminator: EPS mobility management messages (7)
Message authentication code: 0x00000000
Sequence number: 0
0110 .... = EPS bearer identity: 0x06
.... 0010 = Protocol discriminator: EPS session management messages (2)
Procedure transaction identity: 2
NAS EPS session management messages: Activate dedicated EPS bearer context
request (0xc5)
0000 .... = Spare half octet: 0
.... 0101 = Linked EPS bearer identity: EPS bearer identity value 5 (5)
EPS quality of service
Length: 5
Quality of Service Class Identifier (QCI): QCI 4 (4)
Maximum bit rate for uplink : 1984 kbps
Maximum bit rate for downlink : 4992 kbps
Guaranteed bit rate for uplink : 1984 kbps
Guaranteed bit rate for downlink : 4992 kbps
Traffic Flow Template
Length: 25
001. .... = TFT operation code: Create new TFT (1)
...0 .... = E bit: Parameters list is not included
.... 0001 = Number of packet filters: 1
Packet filter 0
00.. .... = Spare bit(s): 0
..10 .... = Packet filter direction: Uplink only (2)
.... 0000 = Packet filter identifier: 0
Packet evaluation precedence: 0x00 (0)
Packet filter length: 0x15 (21)
Packet filter component type identifier: IPv4 remote address type
(16)
IPv4 adress: 11.9.0.54 (11.9.0.54)
IPv4 address mask: 255.255.255.255 (255.255.255.255)
Packet filter component type identifier: Protocol identifier/Next
header type (48)
Protocol/header: 0x01
Packet filter component type identifier: Local port range type (65)
Low limit port: 1024
High limit port: 65535
Packet filter component type identifier: Remote port range type
(81)
Low limit port: 10000
High limit port: 10002
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
