Ask Your Question

Incoherence between ASN.1 and BER on gsm_map

asked 2021-01-28 19:24:20 +0000

joaocoe gravatar image

updated 2021-01-29 10:46:01 +0000

I need to decode a gsm_map protocol using tshark (under pyshark), specified as


Right now, I am able do decode everything up to "sai-Present". However, "eventInfo" gives the error "BER Error: This field lies beyond the end of the known sequence definition" and I'm not able to extract data inside, namely "CancelLocation".

I've been told this happens because there is some incoherence between ASN.1 and BER. According to the specification, "eventInfo" (eventInfo [27] eventInfo OPTIONAL) should be encoded as

Tag    = 0xx9B 
Length = 0x01
Value  = 0x0D          -- cancelLocation

However, it is encoded as "9E 01 0D", as its specification was (eventInfo [30] eventInfo OPTIONAL).

How can I fix this and make tshark able to decode the second encoding version of eventInfo?

I'm running Tshark 2.2.4 on red hat 7.5.

edit retag flag offensive close merge delete


Are you sure about that version?

Jaap gravatar imageJaap ( 2021-01-28 20:30:41 +0000 )edit

yeah, it was wrong. Thanks!

joaocoe gravatar imagejoaocoe ( 2021-01-29 10:45:31 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2021-01-29 09:55:56 +0000

Anders gravatar image

Hi, That looks like propritarry changes not following the 3GPP standard. You would have to recomple packet-gsm_a.c using your propritarry asn1 description and the nrecompile wireshark. Abstract from trunk:

SubscriberLocationReport-Arg ::= SEQUENCE {
    lcs-Event   LCS-Event,
    lcs-ClientID    LCS-ClientID, 
    lcsLocationInfo LCSLocationInfo,
    msisdn  [0] ISDN-AddressString  OPTIONAL,
    imsi        [1] IMSI    OPTIONAL,
    imei        [2] IMEI    OPTIONAL,
    na-ESRD [3] ISDN-AddressString  OPTIONAL,
    na-ESRK [4] ISDN-AddressString  OPTIONAL,
    locationEstimate    [5] Ext-GeographicalInformation OPTIONAL,
    ageOfLocationEstimate   [6] AgeOfLocationInformation    OPTIONAL,
    slr-ArgExtensionContainer   [7] SLR-ArgExtensionContainer   OPTIONAL,
    ... ,
    add-LocationEstimate    [8] Add-GeographicalInformation OPTIONAL,
    deferredmt-lrData   [9] Deferredmt-lrData   OPTIONAL, 
    lcs-ReferenceNumber [10] LCS-ReferenceNumber    OPTIONAL,
    geranPositioningData    [11] PositioningDataInformation OPTIONAL,
    utranPositioningData    [12] UtranPositioningDataInfo   OPTIONAL,
    cellIdOrSai [13]    CellGlobalIdOrServiceAreaIdOrLAI    OPTIONAL,
    h-gmlc-Address  [14]    GSN-Address OPTIONAL,
    lcsServiceTypeID    [15]    LCSServiceTypeID    OPTIONAL,
    sai-Present [17] NULL   OPTIONAL,
    pseudonymIndicator  [18] NULL   OPTIONAL,
    accuracyFulfilmentIndicator [19] AccuracyFulfilmentIndicator    OPTIONAL,
    velocityEstimate    [20] VelocityEstimate   OPTIONAL,
    sequenceNumber  [21] SequenceNumber OPTIONAL,
    periodicLDRInfo [22] PeriodicLDRInfo    OPTIONAL,
    mo-lrShortCircuitIndicator  [23] NULL   OPTIONAL,
    geranGANSSpositioningData   [24] GeranGANSSpositioningData  OPTIONAL,
    utranGANSSpositioningData   [25] UtranGANSSpositioningData  OPTIONAL,
    targetServingNodeForHandover    [26] ServingNodeAddress OPTIONAL,
    utranAdditionalPositioningData  [27] UtranAdditionalPositioningData OPTIONAL,
    utranBaroPressureMeas   [28] UtranBaroPressureMeas  OPTIONAL,
    utranCivicAddress   [29] UtranCivicAddress  OPTIONAL }

    -- one of msisdn or imsi is mandatory
    -- a location estimate that is valid for the locationEstimate parameter should 
    -- be transferred in this parameter in preference to the add-LocationEstimate.
    -- the deferredmt-lrData parameter shall be included if and only if the lcs-Event
    -- indicates a deferredmt-lrResponse.
    -- if the lcs-Event indicates a deferredmt-lrResponse then the locationEstimate 
    -- and the add-locationEstimate parameters shall not be sent if the 
    -- supportedGADShapes parameter had been received in ProvideSubscriberLocation-Arg
    -- and the shape encoded in locationEstimate or add-LocationEstimate was not marked
    -- as supported in supportedGADShapes. In such a case terminationCause 
    -- in deferredmt-lrData shall be present with value 
    -- shapeOfLocationEstimateNotSupported. 
    -- If a lcs event indicates deferred mt-lr response, the lcs-Reference number shall be 
    -- included. 
    -- sai-Present indicates that the cellIdOrSai parameter contains a Service Area Identity.
edit flag offensive delete link more


Thanks for the answer!
I can't seem to find that file on my install. Would you give me some hints on how to do that? i.e., should I download the packet-gsm_a* files from github, recompile and put the result somewhere in wireshark directory?

joaocoe gravatar imagejoaocoe ( 2021-01-29 11:08:21 +0000 )edit

Hi, You need the wireshark sources and set up a build environment then modify the asn1 files here the regenerate the gsm map file from those asn1 files and then build your own version of wireshark from this sources.

Anders gravatar imageAnders ( 2021-01-29 12:11:04 +0000 )edit

Hi Anders, sorry for the absence. So, I've been trying to follow what you told and the ws documentation to do this, but I don't seem to be able to do so. Right now, I've edited the asn1 file "MAP-LCS-DataTypes.asn" in here, in order to add that extra field. I've added a line bellow " utranCivicAddress [29] UtranCivicAddress OPTIONAL }" with that field and a whole description of eventInfo bellow. After building wireshark, things continue not to work. There is something missing from my understanding and I think it's the part of "building the gsm map file from those asn1 files". How do I do this? I've followd the "step by step" guide wireshark provides and still can't make this work. Thanks!

joaocoe gravatar imagejoaocoe ( 2021-02-05 17:28:42 +0000 )edit

Hi, On what os is this? You are a where your map implementation are not standard compliant? Regards Anders

Anders gravatar imageAnders ( 2021-02-06 07:33:52 +0000 )edit

Hi. I'm on Red Hat Enterprise Linux 7. They're not standard compliant but it can be done, right? I'm sorry, this is an ad-hoc thing completely out of my domain area. Thanks, Joao

joaocoe gravatar imagejoaocoe ( 2021-02-06 16:41:52 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-01-28 19:24:20 +0000

Seen: 38 times

Last updated: Jan 29