nas-eps_plain inbound/outbound problem
As you now some of the messages used in the nas-eps_plain protocol require to specify the direction (i.e. Detach request). So I'm using pcapng files containing the packet flags for inbound and outbound. Tshark detects them as expected and shows inbound or outbound but the decoding is always marked with "Uplink". It looks like that pinfo->link_dir is not set.
Sources of 2.9.0rc0-2481 tell
nas_emm_detach_req(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, guint32 offset, guint len)
{
if (pinfo->link_dir == P2P_DIR_UL) {
nas_emm_detach_req_UL(tvb, tree, pinfo, offset, len);
return;
}else if (pinfo->link_dir == P2P_DIR_DL) {
nas_emm_detach_req_DL(tvb, tree, pinfo, offset, len);
return;
}
if (len >= 8) {
nas_emm_detach_req_UL(tvb, tree, pinfo, offset, len);
} else {
nas_emm_detach_req_DL(tvb, tree, pinfo, offset, len);
}
}
Do I miss something? Does the inbound/outbound flag in pcapng not set pinfo->link_dir?