# Incoherence between ASN.1 and BER on gsm_map

I need to decode a gsm_map protocol using tshark (under pyshark), specified as

.

Right now, I am able do decode everything up to "sai-Present". However, "eventInfo" gives the error "BER Error: This field lies beyond the end of the known sequence definition" and I'm not able to extract data inside, namely "CancelLocation".

I've been told this happens because there is some incoherence between ASN.1 and BER. According to the specification, "eventInfo" (eventInfo [27] eventInfo OPTIONAL) should be encoded as

Tag    = 0xx9B
Length = 0x01
Value  = 0x0D          -- cancelLocation


However, it is encoded as "9E 01 0D", as its specification was (eventInfo [30] eventInfo OPTIONAL).

How can I fix this and make tshark able to decode the second encoding version of eventInfo?

I'm running Tshark 2.2.4 on red hat 7.5.

edit retag close merge delete

Are you sure about that version?

( 2021-01-28 20:30:41 +0000 )edit

yeah, it was wrong. Thanks!

( 2021-01-29 10:45:31 +0000 )edit

Sort by » oldest newest most voted

Hi, That looks like propritarry changes not following the 3GPP standard. You would have to recomple packet-gsm_a.c using your propritarry asn1 description and the nrecompile wireshark. Abstract from trunk:

SubscriberLocationReport-Arg ::= SEQUENCE {
lcs-Event   LCS-Event,
lcs-ClientID    LCS-ClientID,
lcsLocationInfo LCSLocationInfo,
imsi        [1] IMSI    OPTIONAL,
imei        [2] IMEI    OPTIONAL,
locationEstimate    [5] Ext-GeographicalInformation OPTIONAL,
ageOfLocationEstimate   [6] AgeOfLocationInformation    OPTIONAL,
slr-ArgExtensionContainer   [7] SLR-ArgExtensionContainer   OPTIONAL,
... ,
deferredmt-lrData   [9] Deferredmt-lrData   OPTIONAL,
lcs-ReferenceNumber [10] LCS-ReferenceNumber    OPTIONAL,
geranPositioningData    [11] PositioningDataInformation OPTIONAL,
utranPositioningData    [12] UtranPositioningDataInfo   OPTIONAL,
cellIdOrSai [13]    CellGlobalIdOrServiceAreaIdOrLAI    OPTIONAL,
lcsServiceTypeID    [15]    LCSServiceTypeID    OPTIONAL,
sai-Present [17] NULL   OPTIONAL,
pseudonymIndicator  [18] NULL   OPTIONAL,
accuracyFulfilmentIndicator [19] AccuracyFulfilmentIndicator    OPTIONAL,
velocityEstimate    [20] VelocityEstimate   OPTIONAL,
sequenceNumber  [21] SequenceNumber OPTIONAL,
periodicLDRInfo [22] PeriodicLDRInfo    OPTIONAL,
mo-lrShortCircuitIndicator  [23] NULL   OPTIONAL,
geranGANSSpositioningData   [24] GeranGANSSpositioningData  OPTIONAL,
utranGANSSpositioningData   [25] UtranGANSSpositioningData  OPTIONAL,
utranBaroPressureMeas   [28] UtranBaroPressureMeas  OPTIONAL,

-- one of msisdn or imsi is mandatory
-- a location estimate that is valid for the locationEstimate parameter should
-- be transferred in this parameter in preference to the add-LocationEstimate.
-- the deferredmt-lrData parameter shall be included if and only if the lcs-Event
-- indicates a deferredmt-lrResponse.
-- if the lcs-Event indicates a deferredmt-lrResponse then the locationEstimate
-- and the add-locationEstimate parameters shall not be sent if the
-- and the shape encoded in locationEstimate or add-LocationEstimate was not marked
-- as supported in supportedGADShapes. In such a case terminationCause
-- in deferredmt-lrData shall be present with value
-- shapeOfLocationEstimateNotSupported.
-- If a lcs event indicates deferred mt-lr response, the lcs-Reference number shall be
-- included.
-- sai-Present indicates that the cellIdOrSai parameter contains a Service Area Identity.

more

I can't seem to find that file on my install. Would you give me some hints on how to do that? i.e., should I download the packet-gsm_a* files from github, recompile and put the result somewhere in wireshark directory?

( 2021-01-29 11:08:21 +0000 )edit

Hi, You need the wireshark sources and set up a build environment then modify the asn1 files here the regenerate the gsm map file from those asn1 files and then build your own version of wireshark from this sources.

( 2021-01-29 12:11:04 +0000 )edit

Hi Anders, sorry for the absence. So, I've been trying to follow what you told and the ws documentation to do this, but I don't seem to be able to do so. Right now, I've edited the asn1 file "MAP-LCS-DataTypes.asn" in here, in order to add that extra field. I've added a line bellow " utranCivicAddress [29] UtranCivicAddress OPTIONAL }" with that field and a whole description of eventInfo bellow. After building wireshark, things continue not to work. There is something missing from my understanding and I think it's the part of "building the gsm map file from those asn1 files". How do I do this? I've followd the "step by step" guide wireshark provides and still can't make this work. Thanks!

( 2021-02-05 17:28:42 +0000 )edit

Hi, On what os is this? You are a where your map implementation are not standard compliant? Regards Anders

( 2021-02-06 07:33:52 +0000 )edit

Hi. I'm on Red Hat Enterprise Linux 7. They're not standard compliant but it can be done, right? I'm sorry, this is an ad-hoc thing completely out of my domain area. Thanks, Joao

( 2021-02-06 16:41:52 +0000 )edit