tshark: RRC container in F1ap message not decoded [closed]

tshark
rrc
f1ap
retag add tags

tshark -v -> 4.2.5

RRC container in the UE context release command not decoded (prints just the hex string)

tshark -r test.pcap -Y "f1ap.procedureCode == 6" -Y "frame.number ==58" -V

     Item 3: id-RRCContainer
                        ProtocolIE-Field
                          id: id-RRCContainer (50)
                            criticality: ignore (1)
                            value
                                RRCContainer: 000610002e7167cb

nrao

asked 2024-06-18 15:40:29 +0000, updated 2024-06-18 20:01:29 +0000

edit flag offensive 0 remove flag reopen merge delete

Closed for the following reason "the question is answered, right answer was accepted" by nrao 2024-06-18 20:05:07 +0000

Comments

Can you provide a capture file or hexdump of the full packet?

Chuckc (2024-06-18 16:11:22 +0000) edit

As Chuckc stated, we need the full F1AP message to check what's going on. The dissection of the RRCContainer opaque object depends on the F1AP message type, procedure code and SRBID field value.

Pascal Quantin (2024-06-18 16:39:45 +0000) edit

How can I share the dump?

nrao (2024-06-18 17:36:15 +0000) edit

@Pascal It was working previously when the order of the IE was srb Id followed by rrc container. Now after correcting the order to rrc container - srb Id, it doesn't decode as expected

nrao (2024-06-18 17:38:32 +0000) edit

Place it on a public file share (Dropbox, Google, Microsoft, ...) and update the question with a link to it.

Chuckc (2024-06-18 18:39:01 +0000) edit

add a comment see more comments

Comments

@Chuckc @Pascal Quantin, after using -2 option in tshark the issue is resolved. Thank you for your time.

nrao (2024-06-18 20:02:38 +0000) edit

tshark: RRC container in F1ap message not decoded [closed] edit

Comments

1 Answer

Comments

tshark: RRC container in F1ap message not decoded [closed]