-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Open
Description
Brief description
The SCTPChunkData payload is not being decoded as DiamG even after binding layers since in my attached example it reports 3867 as a source port.
bind_layers(SCTPChunkData, DiamG, sport=3867)
bind_layers(SCTPChunkData, DiamG, dport=3867)
Scapy version
2.7.0
Python version
3.14
Operating system
Linux 6.18.5-200.fc43.x86_64
Additional environment information
No response
How to reproduce
Read the attached pcap file that contains a single packet and show decoded layers.
Actual result
###[ Ethernet ]###
dst = 9c:af:ca:25:00:07
src = 7c:69:f6:a7:c7:00
type = IPv4
###[ IP ]###
version = 4
ihl = 5
tos = 0xb8
len = 268
id = 16608
flags =
frag = 0
ttl = 48
proto = sctp
chksum = 0x486d
src = 163.162.221.123
dst = 10.224.115.107
\options \
###[ SCTP ]###
sport = 3867
dport = 50108
tag = 0xc6e7ceed
chksum = 0xc544f8d0
###[ SCTPChunkData ]###
type = data
reserved = 0
delay_sack= 0
unordered = 0
beginning = 1
ending = 1
len = 236
tsn = 0x5196937
stream_id = 0x8
stream_seq= 0x67
proto_id = Diameter/SCTP
data = b'\x01\x00\x00\xdc@\x80\x00\x0e\x01\x00\x00K^\x01\x04\xb7Gbj\xfc\x00\x00\x01\x07@\x00\x00Rgmlcsvimi6.tim.it;212619420086580069;1_40_29_0_1504_000;212619420086580064\x00\x00\x00\x00\x01\x0c@\x00\x00\x0c\x00\x00\x07\xd1\x00\x00\x01\x08@\x00\x00\x14hssfe.tim.it\x00\x00\x01(@\x00\x00\x0etim.it\x00\x00\x00\x00\x01\x15@\x00\x00\x0c\x00\x00\x00\x01\x00\x00\x02\xbd\xc0\x00\x00\x12\x00\x00(\xaf\x933\x85(\x17!\x00\x00\x00\x00\ta\xc0\x00\x00$\x00\x00(\xaf\x00\x00\tb\xc0\x00\x00\x17\x00\x00(\xafmme7.tim.it\x00'
Expected result
I would expect DiamG layer to be automatically decoded.
Also calling manually pkt[SCTPChunkData].decode_payload_as(DiamG) does not work properly ...
This is the expected output that I get by calling diameter_layer = DiamG(pkt[SCTPChunkData].data)
###[ Diameter ]###
version = 0x1
drLen = 0xdc
drFlags = 0x40 Answer (-P--)
drCode = 8388622 (LCS-Routing-Info)
drAppId = 3GPP_SLh
drHbHId = 0x5e0104b7
drEtEId = 0x47626afc
\avpList \
|###[ AVP Session-Id ]###
| avpCode = 263
| avpFlags = 0x40 (-M-)
| avpLen = 0x52
| val = b'gmlcsvimi6.tim.it;212619420086580069;1_40_29_0_1504_000;212619420086580064'
|###[ Raw ]###
| load = b'\x00\x00'
|###[ AVP Result-Code ]###
| avpCode = 268
| avpFlags = 0x40 (-M-)
| avpLen = 0xc
| val = DIAMETER_SUCCESS (2001)
|###[ AVP Origin-Host ]###
| avpCode = 264
| avpFlags = 0x40 (-M-)
| avpLen = 0x14
| val = b'hssfe.tim.it'
|###[ AVP Origin-Realm ]###
| avpCode = 296
| avpFlags = 0x40 (-M-)
| avpLen = 0xe
| val = b'tim.it'
|###[ Raw ]###
| load = b'\x00\x00'
|###[ AVP Auth-Session-State ]###
| avpCode = 277
| avpFlags = 0x40 (-M-)
| avpLen = 0xc
| val = NO_STATE_MAINTAINED (1)
|###[ AVP MSISDN ]###
| avpCode = 701
| avpFlags = 0xc0 (VM-)
| avpLen = 0x12
| avpVnd = 3GPP (10415)
| val = b'393358827112'
|###[ Raw ]###
| load = b'\x00\x00'
|###[ AVP Serving-Node ]###
| avpCode = 2401
| avpFlags = 0xc0 (VM-)
| avpLen = 0x24
| avpVnd = 3GPP (10415)
| \val \
| |###[ AVP MME-Name ]###
| | avpCode = 2402
| | avpFlags = 0xc0 (VM-)
| | avpLen = 0x17
| | avpVnd = 3GPP (10415)
| | val = b'mme7.tim.it'
| |###[ Raw ]###
| | load = b'\x00'
Related resources
Metadata
Metadata
Assignees
Labels
No labels