BER Error while dissecting CDR-DATA in gtp prime DRT packet

Question

We have added new dissector to dissect the CDR-DATA present in the data record transfer request (GTP Prime Protocol). We are facing the problem while aligning the information display for one parameter. The expected output is, Frame |Internet Protocol | UDP |_GTP |_EGSNPDPRecord - Record type - IMSI ... ... - list of service data |_Change of service condition |_qosInformationNeg - allocation_ret_priority information ( parameter 1) - delay_class_reliability_class information (parameter 2) ... ... - downlink_gbrate information (parameter 11) - uplink_gbrate information (parameter 12)

To achieve the expected result be have modified the code as below,

========= CODE Start ========================= static int hf_qoSInformationNeg_allocation_ret_priority = -1; static int hf_qoSInformationNeg_delay_class_reliability_class = -1; static int hf_qoSInformationNeg_peak_throughput_precedence_class = -1; static int hf_qoSInformationNeg_mean_throughput = -1; static int hf_qoSInformationNeg_traffic_class_delivery_order_err_sdu = -1; static int hf_qoSInformationNeg_max_sdu_size = -1; static int hf_qoSInformationNeg_max_uplink_bit_rate = -1; static int hf_qoSInformationNeg_max_downlink_bit_rate = -1; static int hf_qoSInformationNeg_residual_ber_sdu_err_ratio = -1; static int hf_qoSInformationNeg_trans_delay_traffic_handling_prio = -1; static int hf_qoSInformationNeg_downlink_gbrate = -1; static int hf_qoSInformationNeg_uplink_gbrate = -1;

.......... .....

static const ber_sequence_t QoSInformationNeg_set[] = { { &hf_qoSInformationNeg_allocation_ret_priority, BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_delay_class_reliability_class, BER_CLASS_CON, 1, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_peak_throughput_precedence_class, BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_mean_throughput, BER_CLASS_CON, 3, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_traffic_class_delivery_order_err_sdu, BER_CLASS_CON, 4, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_max_sdu_size, BER_CLASS_CON, 5, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_max_uplink_bit_rate, BER_CLASS_CON, 6, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_max_downlink_bit_rate, BER_CLASS_CON, 7, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_residual_ber_sdu_err_ratio, BER_CLASS_CON, 8, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_trans_delay_traffic_handling_prio, BER_CLASS_CON, 9, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_downlink_gbrate, BER_CLASS_CON, 10, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { &hf_qoSInformationNeg_uplink_gbrate, BER_CLASS_CON, 11, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_alloc_and_ret_priority}, { NULL, 0, 0, 0, NULL } };

static int dissect_gprschargingdatatypes_QoSInformation(gboolean implicit_tag U_, tvbuff_t tvb U_, int offset _U, asn1_ctx_t actx _U, proto_tree *tree U_, int hf_index _U) {

offset = dissect_ber_set(implicit_tag, actx, tree, tvb, offset, QoSInformationNeg_set, hf_index, ett_gprschargingdatatypes_qoSInformationNeg);

return offset; }

static const ber_sequence_t ChangeOfServiceCondition_sequence[] = { { &hf_gprschargingdatatypes_ratingGroup, BER_CLASS_CON, 1, BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_RatingGroup }, { &hf_gprschargingdatatypes_chargingRuleBaseName, BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_ChargingRuleBaseName }, { &hf_gprschargingdatatypes_resultCode, BER_CLASS_CON, 3, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_ResultCode }, { &hf_gprschargingdatatypes_localSequenceNumber, BER_CLASS_CON, 4, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_LocalSequenceNumber }, { &hf_gprschargingdatatypes_timeOfFirstUsage, BER_CLASS_CON, 5, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_TimeStamp }, { &hf_gprschargingdatatypes_timeOfLastUsage, BER_CLASS_CON, 6, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_TimeStamp }, { &hf_gprschargingdatatypes_timeUsage, BER_CLASS_CON, 7, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_CallDuration }, { &hf_gprschargingdatatypes_serviceConditionChange, BER_CLASS_CON, 8, BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_ServiceConditionChange }, { &hf_gprschargingdatatypes_qoSInformationNeg, BER_CLASS_CON, 9, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_QoSInformation }, { &hf_gprschargingdatatypes_sgsn_Address, BER_CLASS_CON, 10, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG|BER_FLAGS_NOTCHKTAG, dissect_gprschargingdatatypes_GSNAddress }, { &hf_gprschargingdatatypes_sGSNPLMNIdentifier, BER_CLASS_CON, 11, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_PLMN_Id/dissect_gprschargingdatatypes_SGSNPLMNIdentifier/ }, { &hf_gprschargingdatatypes_datavolumeFBCUplink, BER_CLASS_CON, 12, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_DataVolumeGPRS }, { &hf_gprschargingdatatypes_datavolumeFBCDownlink, BER_CLASS_CON, 13, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_DataVolumeGPRS }, { &hf_gprschargingdatatypes_timeOfReport, BER_CLASS_CON, 14, BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_TimeStamp }, { &hf_gprschargingdatatypes_rATType, BER_CLASS_CON, 15, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_RATType }, { &hf_gprschargingdatatypes_failureHandlingContinue, BER_CLASS_CON, 16, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_FailureHandlingContinue }, { &hf_gprschargingdatatypes_serviceIdentifier, BER_CLASS_CON, 17, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_ServiceIdentifier }, { &hf_gprschargingdatatypes_pSFurnishChargingInformation, BER_CLASS_CON, 18, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_PSFurnishChargingInformation }, { &hf_gprschargingdatatypes_userLocationInformation, BER_CLASS_CON, 20, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_OCTET_STRING }, { &hf_gprschargingdatatypes_eventBasedChargingInformation, BER_CLASS_CON, 21, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_EventBasedChargingInformation }, { &hf_gprschargingdatatypes_timeQuotaMechanism, BER_CLASS_CON, 22, BER_FLAGS_OPTIONAL|BER_FLAGS_IMPLTAG, dissect_gprschargingdatatypes_TimeQuotaMechanism }, { NULL, 0, 0, 0, NULL } };

static int dissect_gprschargingdatatypes_ChangeOfServiceCondition(gboolean implicit_tag U_, tvbuff_t tvb U_, int offset _U, asn1_ctx_t actx _U, proto_tree *tree U_, int hf_index _U) { offset = dissect_ber_sequence(implicit_tag, actx, tree, tvb, offset, ChangeOfServiceCondition_sequence, hf_index, ett_gprschargingdatatypes_ChangeOfServiceCondition);

return offset; }

{ &hf_gprschargingdatatypes_qoSInformationNeg,
  { "qoSInformationNeg", "gprschargingdatatypes.qoSInformationNeg",
    FT_NONE, BASE_NONE, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_allocation_ret_priority,
  { "allocation_and_ret_prio", "gprschargingdatatypes.allocation_and_ret_prio",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_delay_class_reliability_class,
  { "delayAndReliabilityClass", "gprschargingdatatypes.delayAndReliabilityClass",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_peak_throughput_precedence_class,
  { "peakThroughputAndPrecedClass", "gprschargingdatatypes.peakThroughputAndPrecedClass",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_mean_throughput,
  { "meanThroughput", "gprschargingdatatypes.meanThroughput",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_traffic_class_delivery_order_err_sdu,
  { "trafficClassDeliveryOrderAndErrSdu", "gprschargingdatatypes.trafficClassDeliveryOrderAndErrSdu",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_max_sdu_size,
  { "maxSduSize", "gprschargingdatatypes.maxSduSize",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_max_uplink_bit_rate,
  { "maxUplinkBitRate", "gprschargingdatatypes.maxUplinkBitRate",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_max_downlink_bit_rate,
  { "maxDownlinkBitRate", "gprschargingdatatypes.maxDownlinkBitRate",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_residual_ber_sdu_err_ratio,
  { "residualBERSduErrRatio", "gprschargingdatatypes.residualBERSduErrRatio",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_trans_delay_traffic_handling_prio,
  { "transDelayAndTrafficHandlingPriority", "gprschargingdatatypes.transDelayAndTrafficHandlingPriority",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_downlink_gbrate,
  { "downlinkGBRate", "gprschargingdatatypes.downlinkGBRate",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},
{ &hf_qoSInformationNeg_uplink_gbrate,
  { "uplinkGBRate", "gprschargingdatatypes.uplinkGBRate",
    FT_UINT32, BASE_DEC, NULL, 0,
    NULL, HFILL }},

========= CODE End =========================

With above changes it displays the label "qosInformationNeg" correctly but while dissecting the parameters it throws an error in dissect_ber_set as below,

BER Error: Unknown field in SET class:UNIVERSAL(0) tag:1 Expert Info (Warn/Malformed): BER Error: Unknown field in SET Message: BER Error: Unknown field in SET BER Error: length:11 longer than tvb_length_remaining:10 Expert Info (Warn/Malformed): BER Error length

Any idea what might be going wrong?

Answer 1

First of all if this is a dissector for standard CDR records transfered in GTP' it would be better to do this trough bugzilla and have the dissector in the released Wireshark in that way you would getr the support of the Wireshark developers. I would use as2wrs to generate the asn1 dissector and call that from packet-gtp.c. ": length:11 longer than tvb_length_remaining" it looks like all the data is not in the tvb. Regards Anders