2024-03-24 22:16:38 +0000 | marked best answer | GTPv1 - 14-digit IMSI marked as malformed 3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface) states that IMSI is
and that
However, some IMSIs can be 14-digits long (3GPP TS 23.003 states the length as "not more than 15 digits"), meaning that the last octet is completely padded (0xFF). Sending such IMSI data in GTPv1 Forward Relocation Request results in Wireshark marking the IMSI as malformed and adding the padding octet as another digit '?'. Is this a false positive in Wireshark and the data is correct? Or is there an exception somewhere in the specifications that allow encoding the IMSI in fewer than 8 octets if it fits? Sample PCAP: https://filebin.net/zbbyiowc9cj9sy2w |
2024-03-24 22:16:38 +0000 | received badge | ● Scholar (source) |
2024-03-20 14:26:25 +0000 | commented question | GTPv1 - 14-digit IMSI marked as malformed I've created the issue: https://gitlab.com/wireshark/wireshark/-/issues/19716 The sample PCAP is uploaded there as well, |
2024-03-20 13:11:33 +0000 | commented question | GTPv1 - 14-digit IMSI marked as malformed @Chuckc: Thanks for looking into this. I'm working with Release-15 of the specs - 29.060, 23.003 I believe the issue is |
2024-03-20 13:07:52 +0000 | commented question | GTPv1 - 14-digit IMSI marked as malformed @Chuckc: Thanks for looking into this. I'm working with Release-15 of the specs - 29.060, 23.003 I believe the issue is |
2024-03-20 13:05:46 +0000 | commented question | GTPv1 - 14-digit IMSI marked as malformed Thanks for looking into this. I'm working with Release-15 of the specs - 29.060, 23.003 I believe the issue is only wit |
2024-03-20 08:38:57 +0000 | commented question | GTPv1 - 14-digit IMSI marked as malformed Sure, I've added a link to a sample capture. |
2024-03-20 08:37:46 +0000 | received badge | ● Editor (source) |
2024-03-20 08:37:46 +0000 | edited question | GTPv1 - 14-digit IMSI marked as malformed GTPv1 - 14-digit IMSI marked as malformed 3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface) |
2024-03-19 15:09:49 +0000 | asked a question | GTPv1 - 14-digit IMSI marked as malformed GTPv1 - 14-digit IMSI marked as malformed 3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface) |