Skip to content

Issue decoding Diameter inside SCTPChunkData #4901

@berrfred

Description

@berrfred

Brief description

The SCTPChunkData payload is not being decoded as DiamG even after binding layers since in my attached example it reports 3867 as a source port.

bind_layers(SCTPChunkData, DiamG, sport=3867)
bind_layers(SCTPChunkData, DiamG, dport=3867)

Scapy version

2.7.0

Python version

3.14

Operating system

Linux 6.18.5-200.fc43.x86_64

Additional environment information

No response

How to reproduce

Read the attached pcap file that contains a single packet and show decoded layers.

Actual result

###[ Ethernet ]###
  dst       = 9c:af:ca:25:00:07
  src       = 7c:69:f6:a7:c7:00
  type      = IPv4
###[ IP ]###
     version   = 4
     ihl       = 5
     tos       = 0xb8
     len       = 268
     id        = 16608
     flags     = 
     frag      = 0
     ttl       = 48
     proto     = sctp
     chksum    = 0x486d
     src       = 163.162.221.123
     dst       = 10.224.115.107
     \options   \
###[ SCTP ]###
        sport     = 3867
        dport     = 50108
        tag       = 0xc6e7ceed
        chksum    = 0xc544f8d0
###[ SCTPChunkData ]###
           type      = data
           reserved  = 0
           delay_sack= 0
           unordered = 0
           beginning = 1
           ending    = 1
           len       = 236
           tsn       = 0x5196937
           stream_id = 0x8
           stream_seq= 0x67
           proto_id  = Diameter/SCTP
           data      = b'\x01\x00\x00\xdc@\x80\x00\x0e\x01\x00\x00K^\x01\x04\xb7Gbj\xfc\x00\x00\x01\x07@\x00\x00Rgmlcsvimi6.tim.it;212619420086580069;1_40_29_0_1504_000;212619420086580064\x00\x00\x00\x00\x01\x0c@\x00\x00\x0c\x00\x00\x07\xd1\x00\x00\x01\x08@\x00\x00\x14hssfe.tim.it\x00\x00\x01(@\x00\x00\x0etim.it\x00\x00\x00\x00\x01\x15@\x00\x00\x0c\x00\x00\x00\x01\x00\x00\x02\xbd\xc0\x00\x00\x12\x00\x00(\xaf\x933\x85(\x17!\x00\x00\x00\x00\ta\xc0\x00\x00$\x00\x00(\xaf\x00\x00\tb\xc0\x00\x00\x17\x00\x00(\xafmme7.tim.it\x00'

Expected result

I would expect DiamG layer to be automatically decoded.
Also calling manually pkt[SCTPChunkData].decode_payload_as(DiamG) does not work properly ...

This is the expected output that I get by calling diameter_layer = DiamG(pkt[SCTPChunkData].data)

###[ Diameter ]###
  version   = 0x1
  drLen     = 0xdc
  drFlags   = 0x40 Answer (-P--)
  drCode    = 8388622 (LCS-Routing-Info)
  drAppId   = 3GPP_SLh
  drHbHId   = 0x5e0104b7
  drEtEId   = 0x47626afc
  \avpList   \
   |###[ AVP Session-Id ]###
   |  avpCode   = 263
   |  avpFlags  = 0x40 (-M-)
   |  avpLen    = 0x52
   |  val       = b'gmlcsvimi6.tim.it;212619420086580069;1_40_29_0_1504_000;212619420086580064'
   |###[ Raw ]###
   |     load      = b'\x00\x00'
   |###[ AVP Result-Code ]###
   |  avpCode   = 268
   |  avpFlags  = 0x40 (-M-)
   |  avpLen    = 0xc
   |  val       = DIAMETER_SUCCESS (2001)
   |###[ AVP Origin-Host ]###
   |  avpCode   = 264
   |  avpFlags  = 0x40 (-M-)
   |  avpLen    = 0x14
   |  val       = b'hssfe.tim.it'
   |###[ AVP Origin-Realm ]###
   |  avpCode   = 296
   |  avpFlags  = 0x40 (-M-)
   |  avpLen    = 0xe
   |  val       = b'tim.it'
   |###[ Raw ]###
   |     load      = b'\x00\x00'
   |###[ AVP Auth-Session-State ]###
   |  avpCode   = 277
   |  avpFlags  = 0x40 (-M-)
   |  avpLen    = 0xc
   |  val       = NO_STATE_MAINTAINED (1)
   |###[ AVP MSISDN ]###
   |  avpCode   = 701
   |  avpFlags  = 0xc0 (VM-)
   |  avpLen    = 0x12
   |  avpVnd    = 3GPP (10415)
   |  val       = b'393358827112'
   |###[ Raw ]###
   |     load      = b'\x00\x00'
   |###[ AVP Serving-Node ]###
   |  avpCode   = 2401
   |  avpFlags  = 0xc0 (VM-)
   |  avpLen    = 0x24
   |  avpVnd    = 3GPP (10415)
   |  \val       \
   |   |###[ AVP MME-Name ]###
   |   |  avpCode   = 2402
   |   |  avpFlags  = 0xc0 (VM-)
   |   |  avpLen    = 0x17
   |   |  avpVnd    = 3GPP (10415)
   |   |  val       = b'mme7.tim.it'
   |   |###[ Raw ]###
   |   |     load      = b'\x00'

Related resources

pcap2_lcs_routing_info_answer.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions