Ask Your Question

[Malformed Packet: PPP PAP]

asked 2018-11-14 09:22:16 +0000

Jim Tan gravatar image

updated 2018-11-14 09:22:50 +0000

I have encountered a problem about malformed packet in PCO of LTE Attach accept The Data after Password Authentication Protocol (0xc023) in PCO cannot decode successfully.

here is the raw data of attach accept 074202e0060002f44000010064520bc1010912046c69766508766f6461666f6e6503636f6d0501c0a801015d0110300e23920a939640687400407f000000320381272e80802110030100108106c0a801028306c0a80103000d04c0a80102000d04c0a8010300100205dcc0230402010004500bf602f440800100000000011302f44000002305f40000000017e059e04a0302f410640103

Password Authentication Protocol is: c0230402010004 Protocol or Container ID: Password Authentication Protocol (0xc023) Length: 0x04 (4) PPP Password Authentication Protocol Code: Authenticate-Ack (2) Identifier: 1 Length: 4

Please tell me why it have problem. Thanks

edit retag flag offensive close merge delete


Can you share a capture file that contains the issue using a publicly accessible link?

grahamb gravatar imagegrahamb ( 2018-11-14 10:53:11 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2018-11-14 11:45:08 +0000

Pascal Quantin gravatar image


you have several issues:

  • fist of all the MME should not send a PAP protocol id in the Attach Accept, it's only supposed to be sent by the UE and no authenticate-ack is required in LTE as far as I know
  • if I read RFC 1334 correctly, the authenticate_ack should have a msg-length field but it is not present, thus the malformed error
edit flag offensive delete link more


Thanks for your reply. after i check RFC 1334. in 2.2. Packet Format, it mention that Data The Data field is zero or more octets. The format of the Data field is determined by the Code field. and in 2.2.1 and 2.2.2, it is impossible that packet's Data field is zero in these three code(request, ack ,Nak). is there any chance that PAP packet's data field is zero?


Jim Tan gravatar imageJim Tan ( 2018-11-15 01:08:42 +0000 )edit

Hi Jim,

Like you I do not see how the data field could be empty with the current specification.

Pascal Quantin gravatar imagePascal Quantin ( 2018-11-15 06:32:46 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-11-14 09:22:16 +0000

Seen: 429 times

Last updated: Nov 14 '18