This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello Guys,

I am trying to extract 3GPP_User_Location_Info from Radius messages. However in this instance it is not extracting info correctly

$ tshark -v TShark 1.10.2 (SVN Rev 51934 from /trunk-1.10)

tshark -T fields -e radius.Calling_Station_Id -e radius.3GPP_User_Location_Info -e radius.3GPP_IMEISV -e radius.Framed-IP-Address -E header=y -E separator=, -E quote=d -r Nikola_TEST_cap.pcap | head

radius.Calling_Station_Id,radius.3GPP_User_Location_Info,radius.3GPP_IMEISV,radius.Framed-IP-Address "6149891xxxx",,"3598220413753808","144.131.70.63" "6145563xxxx",,"3598220423540908","101.175.33.128"

For some reason the 3GPP-User-Location-Id AVP doesn’t get extracted by tshark, although Wireshark shows/decodes the AVP just file.

I upgraded my copy of Wireshark on the Mac to the latest but still seeing the same issue. The AVP is listed in the dictionary and in tshark –G fields so suspect it may be a bug? Other 3GPP fields are extracted ok.

asked 21 Oct '13, 15:34

Nik_NSW_2150's gravatar image

Nik_NSW_2150
1112
accept rate: 0%

edited 21 Oct '13, 17:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237


I can confirm that behavior. Support for 3GPP-User-Location-Info has been added in Bug 7474. Please add a comment with your enhancement request to Bug 7474.

Regards
Kurt

permanent link

answered 21 Oct '13, 16:59

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hello Kurt,

we are running a later version 1.10.2 and the 3GPP-User-Location-Info field is not displaying at all in tshark

(21 Oct '13, 18:23) Nik_NSW_2150

Works with 0.99.7 Windows version and TShark 0.99.7 Somewhere between the version 1.10.2 and 0.99.7 there is a bug.

(21 Oct '13, 20:58) Nik_NSW_2150

Please update Bug 7474.

(22 Oct '13, 00:26) Kurt Knochner ♦

Maybe I was not clear . What I am trying to say is that below works for

TShark 0.99.7 but not for 1.10.2 version

% tshark -T fields -e radius.Calling_Station_Id -e radius.3GPP_User_Location_Info -E header=y -E separator=, -E quote=d -r TEST_cap.pcap | head radius.Calling_Station_Id,radius.3GPP_User_Location_Info "61498913","01:05:f5:10:55:50:16:5a" "6145563","01:05:f5:10:13:50:2e:4d" "614193","01:05:f5:10:10:50:00:eb"

(22 Oct '13, 15:42) Nik_NSW_2150
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×25
×11

question asked: 21 Oct '13, 15:34

question was seen: 3,603 times

last updated: 22 Oct '13, 17:23

p​o​w​e​r​e​d by O​S​Q​A