LTE SIB12 decoding message getting malformed packet with Number of pages should be <=15 (found 65)

Question

Hi All, While decoding LTE SIB12 message i'm getting malformed packet with "Number of pages should be <=15 (found 65)" and after looking into wireshark source code nb_of_pages set to 15 if it is more than 15. Can you please help me to understand why this required ? is it mandatory as per 3GPP specification ? Thanks in advance.

nb_of_pages = tvb_get_guint8(warning_msg_seg_tvb, 0);
ti = proto_tree_add_uint(tree, hf_lte_rrc_warningMessageSegment_nb_pages, warning_msg_seg_tvb, 0, 1, nb_of_pages);
if (nb_of_pages > 15) {
    expert_add_info_format(pinfo, ti, &ei_lte_rrc_number_pages_le15,
                           "Number of pages should be <=15 (found %u)", nb_of_pages);
    nb_of_pages = 15;
}

alt text

Accepted Answer

1

This requirement comes from 3GPP 23.041 chapter 9.3.35, that's why I added this expert info.

If you share the pcap file, I will be able to confirm whether the value 65 is really encoded (in that case Wireshark is right) or if this is a decoding error.

answered 16 Aug '16, 12:06

Pascal Quantin
5.5k●10●60
accept rate: 30%

Hi Pascal, Thank you. I'm capturing logs from RRC layer and format of message is eth:ipv4:udp:1 byte header to identify logical channel:RRC Byte.

For decoding CMAS, calling wireshark built-in dissector "lte-rrc.bcch.dl.sch".

I don't know how to upload file here. So sharing through wiki send

Wireshark pcap: http://wikisend.com/download/937472/CMAS_Wireshark.pcap lua script : http://wikisend.com/download/101712/lterrc.lua

(16 Aug '16, 23:25) svr

1

Your script was missing a line:

dissector:call(payload,pinfo,tree)

But once added, I could decode your framing protocol.

The first byte of the reassembled Warning Message Content E-UTRAN IE is indeed 0x41, which means 65. This does not comply with 3GPP specification. BTW the whole buffer is not compliant with the encoding specified in 23.041 chapter 9.3.35. After manually modifying LTE RRC dissector, it looks like the buffer lacks the number of pages indicated in the fist byte and contains the text: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZAB

Your test tool used to generate this SIB12 (I guess this does not come from a live network) must be reworked.

If I answered your question, do not forget to accept it by clicking on the check mark next to the answer. It will help others.

(17 Aug '16, 10:04) Pascal Quantin