Revision history [back]
GTPv1 - 14-digit IMSI marked as malformed
3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface) states that IMSI is
TBCD-coded with a fixed length of 8 octets
and that
Each unused half octets shall be coded as binary "1 1 1 1"
However, some IMSIs can be 14-digits long (3GPP TS 23.003 states the length as "not more than 15 digits"), meaning that the last octet is completely padded (0xFF). Sending such IMSI data in GTPv1 Forward Relocation Request results in Wireshark marking the IMSI as malformed and adding the padding octet as another digit '?'.
Is this a false positive in Wireshark and the data is correct? Or is there an exception somewhere in the specifications that allow encoding the IMSI in fewer than 8 octets if it fits?
Sample PCAP: https://filebin.net/zbbyiowc9cj9sy2w
GTPv1 - 14-digit IMSI marked as malformed
3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface) states that IMSI is
TBCD-coded with a fixed length of 8 octets
and that
Each unused half octets shall be coded as binary "1 1 1 1"
However, some IMSIs can be 14-digits long (3GPP TS 23.003 states the length as "not more than 15 digits"), meaning that the last octet is completely padded (0xFF). Sending such IMSI data in GTPv1 Forward Relocation Request results in Wireshark marking the IMSI as malformed and adding the padding octet as another digit '?'.
Is this a false positive in Wireshark and the data is correct? Or is there an exception somewhere in the specifications that allow encoding the IMSI in fewer than 8 octets if it fits?
Sample PCAP: https://filebin.net/zbbyiowc9cj9sy2w