5G MM Registration Accept decoding lacks some fields

5G
nas
OTA
retag add tags

Hi,

Wireshark decoding on 5G MM OTA meesage, REGISTRATION_ACCEPT, lacks some fields.

The decoding result:

nas-5gs
    Plain NAS 5GS Message
        5GS network feature support
            nas_5gs.mm.elem_id: 0x00000021
            **gsm_a.len: 2**
            nas_5gs.nw_feat_sup.mpsi: 0
            nas_5gs.nw_feat_sup.iwk_n26: 0
            nas_5gs.nw_feat_sup.emf: 0
            nas_5gs.nw_feat_sup.emc: 0
            nas_5gs.nw_feat_sup.vops_n3gpp: 0
            nas_5gs.nw_feat_sup.vops_3gpp: 1

As above, the len indicates 2, which means there should be 2 octets in the content. According to 3GPP TS24.501, the Octet 4 contains "MCSI" and "EMCN3" two fields.

MCSI: MCS indicator EMCN3: Emergency service support for non-3GPP access indicator

I have tried the latest dev version Wireshark, Wireshark-win64-3.3.0rc0-245-g2060e0202193, still the same result. Please help to check this issue.

Thanks a lot.

Sherry Kuo

asked 2020-01-07 02:55:21 +0000

edit flag offensive 0 remove flag close merge delete

Comments

packet-nas_5gs.c has comments for version:

References: 3GPP TS 24.501 15.1.0

And mentions those fields:

/* 5G-LCS 5G-UP CIoT 5G-HC-CP CIoT N3 data 5G-CP CIoT RestrictEC MCSI EMCN3 octet 4*/

Maybe add a comment to one of the bugs below to check status or if a new bug should be opened:

https://bugs.wireshark.org/bugzilla/s...
https://bugs.wireshark.org/bugzilla/s...

Chuckc (2020-01-07 03:49:05 +0000) edit

Octet 3 is decoded and shown in your decoding result. Doesn't look like code for octet 4 has been added so far.

 852     /* MPSI    IWK N26    EMF    EMC    IMS VoPS    octet 3*/
 853     proto_tree_add_bitmask_list(tree, tvb, offset, 1, flags_oct3, ENC_BIG_ENDIAN);

Chuckc (2020-01-07 04:14:12 +0000) edit

ETSI TS 124 501 V15.5.0 (2019-10):
https://www.etsi.org/deliver/etsi_ts/...
Octet 4 defined in version 15.5.0

Chuckc (2020-01-07 04:19:39 +0000) edit

add a comment see more comments

Comments

"This is now fixed in Wireshark 3.3.0 development tree and it will be part of Wireshark 3.2.1 once released."
https://bugs.wireshark.org/bugzilla/s...

Chuckc (2020-01-07 13:41:55 +0000) edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

5G MM Registration Accept decoding lacks some fields edit

Comments

1 Answer

Comments