Unable to decode LTE HandoverPreparationInformation message

Question

Hi,

I have created a LUA dissector that dissects a custom protocol. This protocol, among other things, transports a LTE HandoverPreparationInformation message (see 3GPP TS 36.331 version 8.21.0 Release 8, section 10.2.2).

The message is well formed, but I can't decode it calling any of the Wireshark dissectors. LTE-RRC and S1AP should be able to decode it (RRC has the lte-rrc.HandoverPreparationInformation_element filter, and S1AP has the s1ap.Source_ToTarget_TransparentContainer filter), but I haven't found the way to call them properly. If I do:

function GetMessageRRC(buffer,pckinfo)
    local dissector = Dissector.get("lte-rrc")
    dissector:call(buffer:tvb(), pckinfo, subtree)
end

I get an error because the dissector doesn't exist. I have to call lte-rrc.ul.ccch or s1ap, but they expect other messages and don't work.

Is there any way to call just the lte-rrc.HandoverPreparationInformation_element or s1ap.Source_ToTarget_TransparentContainer part of the dissector? What am I doing wrong?

Thanks and best regards,

Eduardo.

Accepted Answer

0

Hi,

the registered name for this message (at least in Wireshark 2.0.x) is: "lte_rrc.handover_prep_info"

answered 03 May '16, 09:16

Pascal Quantin
5.5k●10●60
accept rate: 30%

Hi Pascal,

Thanks for your help, but what I was looking for is a way to call the lte-rrc dissector to dissect only that message. If I do:

function GetMessageRRC(buffer,pckinfo) local dissector = Dissector.get("lte_rrc.handover_prep_info") dissector:call(buffer:tvb(), pckinfo, subtree) end

I get a "no such dissector" error message.

Regards,

Eduardo.

(03 May '16, 23:56) EduardoTel

Which Wireshark version are you using? The string I gave you is exactly what you are looking for (a dissector registered by name allowing to decode the Handover Preparation Information message)

register_dissector("lte_rrc.handover_prep_info", dissect_lte_rrc_Handover_Preparation_Info, proto_lte_rrc);

(04 May '16, 06:16) Pascal Quantin

I was using Wireshark V1.12.1. With the latest Wireshark version it works without problems.

Thank you very much for your help and best regards.

(04 May '16, 08:45) EduardoTel