Bliellough's profile - activity

3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface) states that IMSI is

TBCD-coded with a fixed length of 8 octets

and that

Each unused half octets shall be coded as binary "1 1 1 1"

However, some IMSIs can be 14-digits long (3GPP TS 23.003 states the length as "not more than 15 digits"), meaning that the last octet is completely padded (0xFF). Sending such IMSI data in GTPv1 Forward Relocation Request results in Wireshark marking the IMSI as malformed and adding the padding octet as another digit '?'.

Is this a false positive in Wireshark and the data is correct? Or is there an exception somewhere in the specifications that allow encoding the IMSI in fewer than 8 octets if it fits?

Sample PCAP: https://filebin.net/zbbyiowc9cj9sy2w

I've created the issue: https://gitlab.com/wireshark/wireshark/-/issues/19716 The sample PCAP is uploaded there as well,

@Chuckc: Thanks for looking into this. I'm working with Release-15 of the specs - 29.060, 23.003 I believe the issue is

@Chuckc: Thanks for looking into this. I'm working with Release-15 of the specs - 29.060, 23.003 I believe the issue is

Thanks for looking into this. I'm working with Release-15 of the specs - 29.060, 23.003 I believe the issue is only wit

Sure, I've added a link to a sample capture.

GTPv1 - 14-digit IMSI marked as malformed 3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface)

GTPv1 - 14-digit IMSI marked as malformed 3GPP TS 29.060 (GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface)