This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

radius 3GPP_User_Location_Info

0

Hello Guys,

I am trying to extract 3GPP_User_Location_Info from Radius messages. However in this instance it is not extracting info correctly

$ tshark -v TShark 1.10.2 (SVN Rev 51934 from /trunk-1.10)

tshark -T fields -e radius.Calling_Station_Id -e radius.3GPP_User_Location_Info -e radius.3GPP_IMEISV -e radius.Framed-IP-Address -E header=y -E separator=, -E quote=d -r Nikola_TEST_cap.pcap | head

radius.Calling_Station_Id,radius.3GPP_User_Location_Info,radius.3GPP_IMEISV,radius.Framed-IP-Address "6149891xxxx",,"3598220413753808","144.131.70.63" "6145563xxxx",,"3598220423540908","101.175.33.128"

For some reason the 3GPP-User-Location-Id AVP doesn’t get extracted by tshark, although Wireshark shows/decodes the AVP just file.

I upgraded my copy of Wireshark on the Mac to the latest but still seeing the same issue. The AVP is listed in the dictionary and in tshark –G fields so suspect it may be a bug? Other 3GPP fields are extracted ok.

asked 21 Oct '13, 15:34

Nik_NSW_2150's gravatar image

Nik_NSW_2150
1112
accept rate: 0%

edited 21 Oct '13, 17:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237


One Answer:

0

I can confirm that behavior. Support for 3GPP-User-Location-Info has been added in Bug 7474. Please add a comment with your enhancement request to Bug 7474.

Regards
Kurt

answered 21 Oct '13, 16:59

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hello Kurt,

we are running a later version 1.10.2 and the 3GPP-User-Location-Info field is not displaying at all in tshark

(21 Oct '13, 18:23) Nik_NSW_2150

Works with 0.99.7 Windows version and TShark 0.99.7 Somewhere between the version 1.10.2 and 0.99.7 there is a bug.

(21 Oct '13, 20:58) Nik_NSW_2150

Please update Bug 7474.

(22 Oct '13, 00:26) Kurt Knochner ♦

Maybe I was not clear . What I am trying to say is that below works for

TShark 0.99.7 but not for 1.10.2 version

% tshark -T fields -e radius.Calling_Station_Id -e radius.3GPP_User_Location_Info -E header=y -E separator=, -E quote=d -r TEST_cap.pcap | head radius.Calling_Station_Id,radius.3GPP_User_Location_Info "61498913","01:05:f5:10:55:50:16:5a" "6145563","01:05:f5:10:13:50:2e:4d" "614193","01:05:f5:10:10:50:00:eb"

(22 Oct '13, 15:42) Nik_NSW_2150