Revision history [back]

I need to decode a gsm_map protocol using tshark (under pyshark), specified as

.

Right now, I am able do decode everything up to "sai-Present". However, "eventInfo" gives the error "BER Error: This field lies beyond the end of the known sequence definition" and I'm not able to extract data inside, namely "CancelLocation".

I've been told this happens because there is some incoherence between ASN.1 and BER. According to the specification, "eventInfo" (eventInfo [27] eventInfo OPTIONAL) should be encoded as

Tag    = 0xx9B 
Length = 0x01
Value  = 0x0D          -- cancelLocation

However, it is encoded as "9E 01 0D", as its specification was (eventInfo [30] eventInfo OPTIONAL).

How can I fix this and make tshark able to decode the second encoding version of eventInfo?

I'm running Tshark 1.5.3 on red hat 7.5.

I need to decode a gsm_map protocol using tshark (under pyshark), specified as

.

Right now, I am able do decode everything up to "sai-Present". However, "eventInfo" gives the error "BER Error: This field lies beyond the end of the known sequence definition" and I'm not able to extract data inside, namely "CancelLocation".

I've been told this happens because there is some incoherence between ASN.1 and BER. According to the specification, "eventInfo" (eventInfo [27] eventInfo OPTIONAL) should be encoded as

Tag    = 0xx9B 
Length = 0x01
Value  = 0x0D          -- cancelLocation

However, it is encoded as "9E 01 0D", as its specification was (eventInfo [30] eventInfo OPTIONAL).

How can I fix this and make tshark able to decode the second encoding version of eventInfo?

I'm running Tshark 1.5.3 2.2.4 on red hat 7.5.