Ask Your Question

tshark: RRC container in F1ap message not decoded [closed]

asked 2024-06-18 15:40:29 +0000

nrao gravatar image

updated 2024-06-18 20:01:29 +0000

tshark -v -> 4.2.5

RRC container in the UE context release command not decoded (prints just the hex string)

tshark -r test.pcap -Y "f1ap.procedureCode == 6" -Y "frame.number ==58" -V

     Item 3: id-RRCContainer
                          id: id-RRCContainer (50)
                            criticality: ignore (1)
                                RRCContainer: 000610002e7167cb
edit retag flag offensive reopen merge delete

Closed for the following reason the question is answered, right answer was accepted by nrao
close date 2024-06-18 20:05:07.413656


Can you provide a capture file or hexdump of the full packet?

Chuckc gravatar imageChuckc ( 2024-06-18 16:11:22 +0000 )edit

As Chuckc stated, we need the full F1AP message to check what's going on. The dissection of the RRCContainer opaque object depends on the F1AP message type, procedure code and SRBID field value.

Pascal Quantin gravatar imagePascal Quantin ( 2024-06-18 16:39:45 +0000 )edit

How can I share the dump?

nrao gravatar imagenrao ( 2024-06-18 17:36:15 +0000 )edit

@Pascal It was working previously when the order of the IE was srb Id followed by rrc container. Now after correcting the order to rrc container - srb Id, it doesn't decode as expected

nrao gravatar imagenrao ( 2024-06-18 17:38:32 +0000 )edit

Place it on a public file share (Dropbox, Google, Microsoft, ...) and update the question with a link to it.

Chuckc gravatar imageChuckc ( 2024-06-18 18:39:01 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2024-06-18 19:47:54 +0000

Pascal Quantin gravatar image

updated 2024-06-18 20:00:57 +0000

@nrao please provide a pcap, or give details regarding the encapsulation use for the F1AP message so that we can know how to decode the hex dump (a pcap is highly preferred). If the SRBID field is after the RRCContainer one, you need to use 2 pass analysis. Have you tried adding the -2 option to your tshark command line?

edit flag offensive delete link more


@Chuckc@Pascal Quantin, after using -2 option in tshark the issue is resolved. Thank you for your time.

nrao gravatar imagenrao ( 2024-06-18 20:02:38 +0000 )edit

Question Tools


Asked: 2024-06-18 15:40:29 +0000

Seen: 389 times

Last updated: Jun 18