Hi,
This is similar to my quesiton here : https://ask.wireshark.org/question/27981/radius-3gpp-user-location-info-bug-or-my-mistake/ I wasnt sure to post a new question or post it there, I decided to post a new question as it is not the same as my original question.
You can see in the screenshot that the type NG-RAN Node ID (138) is not dissected, and also the combined type with 5GSTAI(139). I assume it should be dissected since 5GS TAI type(136) does properly display TAC, MCC and MNC.
From my understanding NG-RAN Node ID should be displayed something like this:
20 -> number of bits in the ng-eNodeB bit string
length value = 18, short ng-eNodeB ID
length value = 20, ng-eNodeB ID
length value = 21, long ng-eNodeB ID
length value = 22-32, gNodeB ID
62 f2 20 -> MCC/MNC (MCC = 262, MNC = 02)
aa aa aa bb -> gNodeB ID
I have uploaded the pcaps to google drive here:
https://drive.google.com/file/d/1Ygo_YNvZULx8ChJSEGgmfdtK6z3a6nb0/
(note that the requests were sent on udp port 2002 so it should be set to decode as RADIUS protocol)
3GPP references:
3GPP TS 29.061 V17.6.0 (2022-03)
3GPP TS 29.274 V17.5.0 (2022-03)
screenshot:
