Ask Your Question

5G MM Registration Accept decoding lacks some fields

asked 2020-01-07 02:55:21 +0000

Sherry Kuo gravatar image


Wireshark decoding on 5G MM OTA meesage, REGISTRATION_ACCEPT, lacks some fields.

The decoding result:

    Plain NAS 5GS Message
        5GS network feature support
            **gsm_a.len: 2**
            nas_5gs.nw_feat_sup.mpsi: 0
            nas_5gs.nw_feat_sup.iwk_n26: 0
            nas_5gs.nw_feat_sup.emf: 0
            nas_5gs.nw_feat_sup.emc: 0
            nas_5gs.nw_feat_sup.vops_n3gpp: 0
            nas_5gs.nw_feat_sup.vops_3gpp: 1

As above, the len indicates 2, which means there should be 2 octets in the content. According to 3GPP TS24.501, the Octet 4 contains "MCSI" and "EMCN3" two fields.

MCSI: MCS indicator EMCN3: Emergency service support for non-3GPP access indicator

I have tried the latest dev version Wireshark, Wireshark-win64-3.3.0rc0-245-g2060e0202193, still the same result. Please help to check this issue.

Thanks a lot.

edit retag flag offensive close merge delete


packet-nas_5gs.c has comments for version:

References: 3GPP TS 24.501 15.1.0

And mentions those fields:

/* 5G-LCS 5G-UP CIoT 5G-HC-CP CIoT N3 data 5G-CP CIoT RestrictEC MCSI EMCN3 octet 4*/

Maybe add a comment to one of the bugs below to check status or if a new bug should be opened:

Chuckc gravatar imageChuckc ( 2020-01-07 03:49:05 +0000 )edit

Octet 3 is decoded and shown in your decoding result. Doesn't look like code for octet 4 has been added so far.

 852     /* MPSI    IWK N26    EMF    EMC    IMS VoPS    octet 3*/
 853     proto_tree_add_bitmask_list(tree, tvb, offset, 1, flags_oct3, ENC_BIG_ENDIAN);
Chuckc gravatar imageChuckc ( 2020-01-07 04:14:12 +0000 )edit

ETSI TS 124 501 V15.5.0 (2019-10):
Octet 4 defined in version 15.5.0

Chuckc gravatar imageChuckc ( 2020-01-07 04:19:39 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-01-07 05:00:17 +0000

Jaap gravatar image

Requests for enhancements are handled through the bug database, as indicated by @bubbasnmp in his comments. Please add your request there, and if possible with a capture file showing the issue. Do not add screenshots, we can't work with them.

edit flag offensive delete link more


"This is now fixed in Wireshark 3.3.0 development tree and it will be part of Wireshark 3.2.1 once released."

Chuckc gravatar imageChuckc ( 2020-01-07 13:41:55 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-01-07 02:55:21 +0000

Seen: 545 times

Last updated: Jan 07 '20