This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Decode GTPv2 TEID as Decimal or Hex?

0

Hello,

When I check GTPv2 message with expanding subtree, it is found that TEID is decoded as decimal as below.


TEID/GRE Key: 34604084



But in top of subtree it is decoded as hex as below.


Fully Qualified Tunnel Endpoint Identifier (F-TEID) : S11 MME GTP-C interface, TEID/GRE Key: 0x02100434, IPv4 10.64.194.1



I'm wondering both should be hex but is there anyone who knows reason of this?

asked 31 Aug '13, 00:41

Kaz's gravatar image

Kaz
11113
accept rate: 0%

edited 31 Aug '13, 07:44

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


One Answer:

2

is there anyone who knows reason of this?

Yes. That's how Anders Broman coded it when he committed the change in r35378.

answered 31 Aug '13, 07:52

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Thanks for the comment! Do you know any intention? I also re-checked other pcap files and as long as I check GTP version 1 and S1AP seem to decode as Hex as below.

S1AP

gTP-TEID: 052c2201

GTP version1

TEID: 0x22000db5

So for me, unifying to hex looks beautiful rather than mix hex and decimal. But there might be some purpose for the future use. Do you know any reason?

(31 Aug '13, 09:43) Kaz

Well, it'd probably be better if the representation was consistent, but whether it should be displayed as hexadecimal, decimal, or both may be subjective. What does the GTPv2 specification say about how this field should be represented?

In any case, feel free to open a bug report asking for the value to be consistently displayed.

(03 Sep '13, 07:46) cmaynard ♦♦

In 3GPP TS 36.444, it seems saying TEID type is octets string. But overall there seems no clear definition...

I also think it is not right or wrong answer to display as whether hexadecimal or decimal in the current situation.

Well, let's see if bug report would help to get conclusion about this question. :)

(04 Sep '13, 17:33) Kaz

Since it's an octet string, I think the right thing to do is to display it in hexadecimal. I committed a change in r51789 to do that and scheduled the change to the roadmap for 1.10.2 and 1.8.102.

(05 Sep '13, 11:59) cmaynard ♦♦

Sorry, for late response. Thanks a lot for help!

(11 Sep '13, 23:45) Kaz

Hi, Have been a wireshark + GTP user for quite some time now. Just realized that teid displayed value is in decimal for gtpv2.teid however hex for gtpv2.f_teid_gre_key.

This is again inconvenient while trying to analyse /observe GTP flows. Can we please make the gtpv2.teid as HEX.

5345 { &hf_gtpv2_t, 5346 {"TEID flag (T)", "gtpv2.t", 5347 FT_UINT8, BASE_DEC, NULL, 0x08, 5348 "If TEID field is present or not", HFILL} 5349 }, 5350 { &hf_gtpv2_message_type,

(03 Nov '14, 22:32) PKR

Wireshark development releases already dump the gtpv2.teid as HEX and DEC. You just need to upgrade to a nightly build as found here: https://www.wireshark.org/download/automated/

(04 Nov '14, 05:46) Pascal Quantin

Hi, Was this issue ever solved? I have WS 1.12.7 and still see GTPv2 pkts TEID and SQN in decimal but not Hexa.

Thanks a lot

Br, Bulphi

(07 Oct '15, 06:33) 109

This change is part of the upcoming Wireshark 2.0. In the meantime you can already download the 1.99.9 development preview from Wireshark download page.

(07 Oct '15, 07:01) Pascal Quantin

From the comment of @cmaynard from Sept 5, 2013(!) I would expect it to be in the 1.12 branch already. And backported to 1.10. and 1.8 as per comment on r51789. Did this make it into the git repo?

(07 Oct '15, 07:32) Jaap ♦

This was done for the gtpv2.f_teid_gre_key field, not for the gtpv2.teid field. This one is changed in 2.0 branch.

(07 Oct '15, 08:57) Pascal Quantin
showing 5 of 11 show 6 more comments