NAS 5GS Malformed Packet Decoding SOR transparent container PLMN ID and access technology list
Summary
Recently, we encountered a circumstance where Wireshark is classifying a packet as malformed, despite the fact that our application logs showed that everything was operating OK. We are worried about this because we use Wireshark for packet analysis and debugging.
Sample capture fileimage
What is the current bug behavior?
Let me summarize the issue in detail. Initial issue we faced is Issue-1{} Issue-1: When N<8 'Plmn and AccessTechnologyIdentifiers' are sent by UDM in AM Subscription Data, then Amf sent RegistrationAccept packet is malformed. * Initially we thought AMF should send atleast 8 'Plmn&AccessTechnology' in RegistrationAccept, so a fix was provided (in which Amf sends atleast 8 'Plmn&AccessTechnology' in RegistrationAccept) • With that fix, Issue-1 was resolved and we faced Issue-2. • AMF should transparently forward the UDM sent 'N' Plmn&AccessTechnologyIdentifier's in RegistrationAccept. The exisiting implementation is already like that. So, Amf no need to fill atleast N=8 items, hence the fix which was provided for this Jira is not required. • Thus, if N<8 'Plmn&AccessTechnology' are sent by UDM, that is considered as operator issue.{} Solution: • Update testcase such that UDM always sends atleast 8 'Plmn&AccessTechnology' in AM Subscription Data. Then it should work without any fix.
After issue-1 is resolved, we faced issue-2
Issue-2: When N>=8 'Plmn and AccessTechnologyIdentifiers' are sent by UDM in AM Subscription Data, then Amf sent correct RegistrationAccept packet but wireshark is decoding 'sorTransparentContainer IE' incorrectly. * Amf sent HexStream are manually verified and confirmed that Amf encoding is correct and as per spec • Only wireshark is decoding it incorrectly • Wireshark incorrectly takes 6 bytes as Plmn while decoding(sorTransparentContainer IE) but as per spec only Plmn is only 3 bytes. Comment: • It is not application issue, it is issue with wireshark decoding.
Build information
Version 4.0.7 (v4.0.7-0-g0ad1823cc090).
Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.32, build 31332),
with GLib 2.72.3, with PCRE2, with zlib 1.2.12, with Qt 5.15.2, with libpcap,
with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.10.1, with
Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with
Zstandard, with Snappy, with libxml2 2.9.14, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using WinSparkle 0.8.0, with AirPcap, with
SpeexDSP (using bundled resampler), with Minizip, with binary plugins.
Running on 64-bit Windows 10 (22H2), build 19045, with Intel(R) Core(TM)
i7-10510U CPU @ 1.80GHz (with SSE4.2), with 16157 MB of physical memory, with
GLib 2.72.3, with PCRE2 10.40 2022-04-14, with Qt 5.15.2, with Npcap version
1.71, based on libpcap version 1.10.2-PRE-GIT, with c-ares 1.18.1, with GnuTLS
3.6.3, with Gcrypt 1.10.1, with nghttp2 1.46.0, with brotli 1.0.9, with LZ4
1.9.3, with Zstandard 1.5.2, without AirPcap, with light display mode, with
mixed DPI, with LC_TYPE=English_India.utf8, binary plugins supported.