This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why is the ASN.1 IPv6 address in s1ap E-RABToBeSetupListCtxtSUReq not displaying?

0

I'm using wireshark to decode the s1ap InitialContextSetupRequest but it doesn't seem to display the IPv6 address of the transportLayerAddress. When decoding IPv4 it displays it fine but not when IPv4 and IPv6 are included. Is this a decodeAs issue or encoding error?

Item 3: id-E-RABToBeSetupListCtxtSUReq
                            ProtocolIE-Field
                                id: id-E-RABToBeSetupListCtxtSUReq (24)
                                criticality: reject (0)
                                value
                                    E-RABToBeSetupListCtxtSUReq: 1 item
                                        Item 0: id-E-RABToBeSetupItemCtxtSUReq
                                            ProtocolIE-SingleContainer
                                                id: id-E-RABToBeSetupItemCtxtSUReq (52)
                                                criticality: reject (0)
                                                value
                                                    E-RABToBeSetupItemCtxtSUReq
                                                        e-RAB-ID: 5
                                                        e-RABlevelQoSParameters
                                                        0... .... Extension Present Bit: False
                                                        transportLayerAddress: 9ba562c22606ae00204113000000000000000002 [bit length 160]
                                                        gTP-TEID: 83acc06b
                                                        nAS-PDU: 278541ea3402074202540620130181f20400755228c10108...
                                                        Non-Access-Stratum (NAS)PDU

Wireshark version:

Version 1.8.3 (SVN Rev Unknown from unknown)

Copyright 1998-2012 Gerald Combs <[email protected]> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


Compiled (64-bit) with GTK+ 2.18.9, with Cairo 1.8.8, with Pango 1.28.1, with GLib 2.22.5, with libpcap, with libz 1.2.3, without POSIX capabilities, without SMI, without c-ares, without ADNS, without Lua, without Python, with GnuTLS
2.8.5, with Gcrypt 1.4.5, with MIT Kerberos, without GeoIP, without PortAudio, with AirPcap.


Running on Linux
2.6.32-279.el6.x86_64, with locale en_US.UTF-8, with libpcap version
1.0.0, with libz 1.2.3, GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.


Built using gcc 4.4.6 20110731 (Red Hat 4.4.6-3).

asked 13 Jun ‘14, 08:26

run4life's gravatar image

run4life
11●1●1●2
accept rate: 0%

Could you upload the file and post a link? That way I can at least check the newer versions, as 1.8.3 has been out for quite some time now. I suggest trying 1.10.8 if you haven’t already.

https://appliance.cloudshark.org/upload/

Also for reference, this looks like the relevant code in 1.10.8, in packet-s1ap.c:

    dissect_s1ap_TransportLayerAddress(tvbuff_t *tvb U, int offset U, asn1_ctx_t *actx U, proto_tree *tree U, int hf_index U) {
#line 250 "../../asn1/s1ap/s1ap.cnf"
tvbuff_t *parameter_tvb=NULL;
proto_tree *subtree;
gint tvb_len;


offset = dissect_per_bit_string(tvb, offset, actx, tree, hf_index,
1, 160, TRUE, ¶meter_tvb);


if (!parameter_tvb)
return offset;


/* Get the length */
tvb_len = tvb_length(parameter_tvb);
subtree = proto_item_add_subtree(actx-&gt;created_item, ett_s1ap_TransportLayerAddress);
if (tvb_len==4){
    /* IPv4 */
     proto_tree_add_item(subtree, hf_s1ap_transportLayerAddressIPv4, parameter_tvb, 0, tvb_len, ENC_BIG_ENDIAN);
}
if (tvb_len==16){
    /* IPv6 */
     proto_tree_add_item(subtree, hf_s1ap_transportLayerAddressIPv6, parameter_tvb, 0, tvb_len, ENC_NA);
}



return offset;
}
(13 Jun ‘14, 17:22) Quadratic

The current code supports an IPv4 address, an IPv6 address, but not an Ipv4v6 one. Please fill a bug report on http://bugs.wireshark.org with your sample pcap attached.

(15 Jun ‘14, 13:52) Pascal Quantin