This is our old Q&A Site. Please post any new questions and answers at

I'm using wireshark to decode the s1ap InitialContextSetupRequest but it doesn't seem to display the IPv6 address of the transportLayerAddress. When decoding IPv4 it displays it fine but not when IPv4 and IPv6 are included. Is this a decodeAs issue or encoding error?

Item 3: id-E-RABToBeSetupListCtxtSUReq
                                id: id-E-RABToBeSetupListCtxtSUReq (24)
                                criticality: reject (0)
                                    E-RABToBeSetupListCtxtSUReq: 1 item
                                        Item 0: id-E-RABToBeSetupItemCtxtSUReq
                                                id: id-E-RABToBeSetupItemCtxtSUReq (52)
                                                criticality: reject (0)
                                                        e-RAB-ID: 5
                                                        0... .... Extension Present Bit: False
                                                        transportLayerAddress: 9ba562c22606ae00204113000000000000000002 [bit length 160]
                                                        gTP-TEID: 83acc06b
                                                        nAS-PDU: 278541ea3402074202540620130181f20400755228c10108...
                                                        Non-Access-Stratum (NAS)PDU

Wireshark version:

Version 1.8.3 (SVN Rev Unknown from unknown)

Copyright 1998-2012 Gerald Combs <[email protected]> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.18.9, with Cairo 1.8.8, with Pango 1.28.1, with GLib 2.22.5, with libpcap, with libz 1.2.3, without POSIX capabilities, without SMI, without c-ares, without ADNS, without Lua, without Python, with GnuTLS
2.8.5, with Gcrypt 1.4.5, with MIT Kerberos, without GeoIP, without PortAudio, with AirPcap.

Running on Linux
2.6.32-279.el6.x86_64, with locale en_US.UTF-8, with libpcap version
1.0.0, with libz 1.2.3, GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.

Built using gcc 4.4.6 20110731 (Red Hat 4.4.6-3).

asked 13 Jun '14, 08:26

run4life's gravatar image

accept rate: 0%

Could you upload the file and post a link? That way I can at least check the newer versions, as 1.8.3 has been out for quite some time now. I suggest trying 1.10.8 if you haven't already.

Also for reference, this looks like the relevant code in 1.10.8, in packet-s1ap.c:

    dissect_s1ap_TransportLayerAddress(tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) {
#line 250 "../../asn1/s1ap/s1ap.cnf"
  tvbuff_t *parameter_tvb=NULL;
  proto_tree *subtree;
  gint tvb_len;

  offset = dissect_per_bit_string(tvb, offset, actx, tree, hf_index,
                                     1, 160, TRUE, ┬Âmeter_tvb);

  if (!parameter_tvb)
    return offset;

    /* Get the length */
    tvb_len = tvb_length(parameter_tvb);
    subtree = proto_item_add_subtree(actx->created_item, ett_s1ap_TransportLayerAddress);
    if (tvb_len==4){
        /* IPv4 */
         proto_tree_add_item(subtree, hf_s1ap_transportLayerAddressIPv4, parameter_tvb, 0, tvb_len, ENC_BIG_ENDIAN);
    if (tvb_len==16){
        /* IPv6 */
         proto_tree_add_item(subtree, hf_s1ap_transportLayerAddressIPv6, parameter_tvb, 0, tvb_len, ENC_NA);

  return offset;
(13 Jun '14, 17:22) Quadratic

The current code supports an IPv4 address, an IPv6 address, but not an Ipv4v6 one. Please fill a bug report on with your sample pcap attached.

(15 Jun '14, 13:52) Pascal Quantin
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 13 Jun '14, 08:26

question was seen: 1,445 times

last updated: 15 Jun '14, 13:52

p​o​w​e​r​e​d by O​S​Q​A