Wireshark · Wireshark-users: Re: [Wireshark-users] why there is a malformed?

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2014-02-23 9:26 GMT+01:00 damker <damker@xxxxxxxx>:

the attachment file is a sample file for lte rrc message(pls set user_dlt 147 as lte-rrc.ul.dcch ), there is a malformed error,

as shown below, is the red mark should be decoded as "ultraTDD128"?

Hi,

the packet is malformed and Wireshark decoding correct:

- the UE Capability RAT container has a size of only 12 bytes and the interRAT parameters IE already reaches the last byte of the container

- the interRAT-Parameters IE indicates that only utraFDD optional IE is present

You can check it yourself by activating the PER internal debug output by ticking Preferences -> Protocols -> PER -> "Display the internal PER fields in the tree".

I also checked the encoding of the UE EUTRA Capability IE and it also complains about a size too short.

Best regards,
Pascal.