This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi All, While decoding LTE SIB12 message i'm getting malformed packet with "Number of pages should be <=15 (found 65)" and after looking into wireshark source code nb_of_pages set to 15 if it is more than 15. Can you please help me to understand why this required ? is it mandatory as per 3GPP specification ? Thanks in advance.

nb_of_pages = tvb_get_guint8(warning_msg_seg_tvb, 0);
ti = proto_tree_add_uint(tree, hf_lte_rrc_warningMessageSegment_nb_pages, warning_msg_seg_tvb, 0, 1, nb_of_pages);
if (nb_of_pages > 15) {
    expert_add_info_format(pinfo, ti, &ei_lte_rrc_number_pages_le15,
                           "Number of pages should be <=15 (found %u)", nb_of_pages);
    nb_of_pages = 15;
}

alt text

asked 16 Aug '16, 06:53

svr's gravatar image

svr
11114
accept rate: 0%

edited 16 Aug '16, 07:17

grahamb's gravatar image

grahamb ♦
19.8k330206


This requirement comes from 3GPP 23.041 chapter 9.3.35, that's why I added this expert info.

If you share the pcap file, I will be able to confirm whether the value 65 is really encoded (in that case Wireshark is right) or if this is a decoding error.

permanent link

answered 16 Aug '16, 12:06

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

Hi Pascal, Thank you. I'm capturing logs from RRC layer and format of message is eth:ipv4:udp:1 byte header to identify logical channel:RRC Byte.

For decoding CMAS, calling wireshark built-in dissector "lte-rrc.bcch.dl.sch".

I don't know how to upload file here. So sharing through wiki send

Wireshark pcap: http://wikisend.com/download/937472/CMAS_Wireshark.pcap lua script : http://wikisend.com/download/101712/lterrc.lua

(16 Aug '16, 23:25) svr
1

Your script was missing a line:

dissector:call(payload,pinfo,tree)

But once added, I could decode your framing protocol.

The first byte of the reassembled Warning Message Content E-UTRAN IE is indeed 0x41, which means 65. This does not comply with 3GPP specification. BTW the whole buffer is not compliant with the encoding specified in 23.041 chapter 9.3.35. After manually modifying LTE RRC dissector, it looks like the buffer lacks the number of pages indicated in the fist byte and contains the text: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZAB

Your test tool used to generate this SIB12 (I guess this does not come from a live network) must be reworked.

If I answered your question, do not forget to accept it by clicking on the check mark next to the answer. It will help others.

(17 Aug '16, 10:04) Pascal Quantin
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×36
×14
×1
×1

question asked: 16 Aug '16, 06:53

question was seen: 1,655 times

last updated: 17 Aug '16, 10:05

p​o​w​e​r​e​d by O​S​Q​A