REGISTER packet with UTF-8 characters

asked 2021-05-13 13:04:25 +0000

updated 2021-05-13 15:06:33 +0000

grahamb gravatar image

I'm receiving REGISTER packets with UTF-8 characters. I've been told this packet is corrupt but I'm trying to see if there's something I'm missing or Wireshark isn't interpreting this information correctly.

Has anyone seen this before ?

Request-Line: REGISTER sip:�����~:5060 SIP/2.0
    Method: REGISTER
    Request-URI: sip:�����~:5060
        Request-URI Host Part: �����~
        Request-URI Host Port: 5060
    [Resent Packet: False]

This is a REGISTER packet coming from a softphone on a cellular phone. I've narrowed it down to the cellular network provider causing the issue. But obviously they are not helping much.... This will work with any cellular phone model and provider besides this particular provider. Swap out the SIM card and the register packets come in as expected.

edit retag flag offensive close merge delete

Comments

I've been told this packet is corrupt

By Wireshark, by the host to which the cell phone was sending the SIP packet, or by somebody else?

The "�����" is an indication that there are probably byte sequences in the register packet that are not valid in UTF-8. If you click on the "Request-URI Host Part: �����~" line in Wireshark, it should select, in the hex data pane, the bytes of that part of the packet; check those to see why some of them don't correspond to a valid encoding of UTF-8. (The only way in which they would be a valid encoding of UTF-8 would be if they were a valid encoding of 5 instances of the Unicode REPLACEMENT CHARACTER followed by an ASCII tilde. If that's the case, they're probably still not a valid SIP URL.)

Guy Harris gravatar imageGuy Harris ( 2021-05-14 07:11:27 +0000 )edit