Skip to content

Wireshark does not recognize GTP-U header , in scenario where Inner IPs are IPV6 Address Family. #2008

Description

@asingh1984

Brief description

Wireshark does not recognize GTP-U header , in scenario where Inner IPs are IPV6 Address Family.
Wireshark does recognize GTP-U header , in scenario where Inner IPs are IPV4 Address Family.

Environment

OS - 14.04.1-Ubuntu
Python Version - Python 2.7.6
Scapy Version - (2.4.3rc1.dev128)

  1. I'm using following file for crafting gtp packets
    https://github.com/cisco-system-traffic-generator/trex-core/blob/master/scripts/external_libs/scapy-2.3.1/python3/scapy/contrib/gtp.py

  2. Run gtp.py file

sudo python gtp.py

How to reproduce

I'm trying to craft GTP-U packets , for the following address family scenarios.
a) For Inner IPv4 scenarios - Wireshark do recognize it as GTP packets
b) But For Inner IPv6 scenarios - Wireshark does not recognize it as GTP packets (Wireshark just treats it as data.. )

Following are the Scapy commands to generate , GTP-U packets

A) Outer IPv4 and Inner IPv4 --> Wireshark does recognize it as GTP packets.

send(IP(src="101.101.101.1",dst="101.101.101.81")/UDP(sport=2152,dport=2152)/GTP_U_Header(TEID=9999)/IP(src="1.1.1.1", dst="2.2.2.2")/UDP(sport=1111,dport=2222),inter=0.01,count=10)

B) Outer IPv6 and Inner IPv4 --> Wireshark does recognize it as GTP packets.

send(IPv6(src="2002::101:101:101:1",dst="2002::101:101:101:81")/UDP(sport=2152,dport=2152)/GTP_U_Header(TEID=9999)/IP(src="1.1.1.1", dst="2.2.2.2"),inter=0.01,count=101)

C) Outer IPv4 and Inner IPv6 --> Wireshark does not !!! recognize it as GTP packets. (Wireshark just treats it as data.. )

send(IP(src="101.101.101.1",dst="101.101.101.81")/UDP(sport=2152,dport=2152)/GTP_U_Header(TEID=9999)/IPv6(src="2002::101:101:101:1",dst="2002::102:102:102:1")/UDP(sport=1111,dport=2222),inter=0.01,count=101)

D) Outer IPv6 and Inner IPv6 --> Wireshark does not !!! recognize it as GTP packets.(Wireshark just treats it as data.. )

send(IPv6(src="2002::101:101:101:1",dst="2002::101:101:101:81")/UDP(sport=2152,dport=2152)/GTP_U_Header(TEID=9999)/IPv6(src="2002::101:101:101:1",dst="2002::102:102:102:1")/UDP(sport=1111,dport=2222),inter=0.01,count=10)

Actual result

Wireshark recognize GTP-U header as a generic Data , in scenario where Inner IP is IPV6 Address Family. (Example C & D above)

GTP_U_Headers_are_recognized_as_data_for_Inner_IPv6_address

Wireshark recognizes GTP-U header , in scenario where Inner IP is IPV4 Address Family.

GTP_U_Headers_are_recognized_for_IPv4_Inner_Address

Expected result

Wireshark should recognize GTP-U header ( not a generic data) , in scenario where Inner IP is IPV6 Address Family.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions