Ask Your Question
0

nas-eps_plain inbound/outbound problem

asked 2018-11-19 11:30:19 +0000

mos gravatar image

updated 2018-11-19 11:33:50 +0000

grahamb gravatar image

As you now some of the messages used in the nas-eps_plain protocol require to specify the direction (i.e. Detach request). So I'm using pcapng files containing the packet flags for inbound and outbound. Tshark detects them as expected and shows inbound or outbound but the decoding is always marked with "Uplink". It looks like that pinfo->link_dir is not set.

Sources of 2.9.0rc0-2481 tell

nas_emm_detach_req(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, guint32 offset, guint len)
{
    if (pinfo->link_dir == P2P_DIR_UL) {
        nas_emm_detach_req_UL(tvb, tree, pinfo, offset, len);
        return;
    }else if (pinfo->link_dir == P2P_DIR_DL) {
        nas_emm_detach_req_DL(tvb, tree, pinfo, offset, len);
        return;
    }
    if (len >= 8) {
        nas_emm_detach_req_UL(tvb, tree, pinfo, offset, len);
    } else {
        nas_emm_detach_req_DL(tvb, tree, pinfo, offset, len);
    }
}

Do I miss something? Does the inbound/outbound flag in pcapng not set pinfo->link_dir?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-11-19 13:00:55 +0000

Anders gravatar image

Does the inbound/outbound flag in pcapng not set pinfo->linkdir? No it does not. I think the code snippet expects the caller to have set pinfo->linkdir and if the standard code does not do that we'd need a sample pacap and a bug report to try to figure out how to fix that.

edit flag offensive delete link more

Comments

OK, I will setup a bug report and attach the pcapngs I used for test.

mos gravatar imagemos ( 2018-11-19 13:07:44 +0000 )edit

And as you can see the code has an heuristic in case link_dir (which differs from the p2p_dir flag set by the pcapng header) is not set. The heuristic is strong enough (if your Detach Request message is valid) given that they have a different length in UL and DL. I do not see any bug in the current code.

Pascal Quantin gravatar imagePascal Quantin ( 2018-11-19 13:07:59 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-11-19 11:30:19 +0000

Seen: 419 times

Last updated: Nov 19 '18