GPRS: Add script to track the N(U) on GPRS LLC messages..
tshark -q -X lua_script:gprs/gprs-verify-nu.lua -r trace.pcap Output: JUMP in N(U) on TLLI 3741437425 and SAPI: 9 last: 1 now: 3 JUMP in N(U) on TLLI 3741437425 and SAPI: 9 last: 10 now: 12
This commit is contained in:
parent
8acedec8c9
commit
7d3b3d0e71
|
@ -0,0 +1,55 @@
|
|||
-- This script verifies that the N(U) is increasing...
|
||||
--
|
||||
do
|
||||
local nu_state_src = {}
|
||||
|
||||
local function init_listener()
|
||||
-- handle the port as NS over IP
|
||||
local udp_port_table = DissectorTable.get("udp.port")
|
||||
local gprs_ns_dis = Dissector.get("gprs_ns")
|
||||
udp_port_table:add(23000,gprs_ns_dis)
|
||||
|
||||
-- we want to look here...
|
||||
local llc_sapi_get = Field.new("llcgprs.sapib")
|
||||
local llc_nu_get = Field.new("llcgprs.nu")
|
||||
local bssgp_tlli_get = Field.new("bssgp.tlli")
|
||||
|
||||
local tap = Listener.new("ip", "udp.port == 23000")
|
||||
function tap.packet(pinfo,tvb,ip)
|
||||
local llc_sapi = llc_sapi_get()
|
||||
local llc_nu = llc_nu_get()
|
||||
local bssgp_tlli = bssgp_tlli_get()
|
||||
|
||||
if not llc_sapi or not llc_nu or not bssgp_tlli then
|
||||
return
|
||||
end
|
||||
|
||||
local ip_src = tostring(ip.ip_src)
|
||||
local bssgp_ttli = tostring(bssgp_tlli)
|
||||
local llc_nu = tostring(llc_nu)
|
||||
local llc_sapi = tostring(llc_sapi)
|
||||
|
||||
local src_key = ip_src .. "-" .. bssgp_ttli .. "-" .. llc_sapi
|
||||
local last_nu = nu_state_src[src_key]
|
||||
if not last_nu then
|
||||
-- print("Establishing mapping for " .. src_key)
|
||||
nu_state_src[src_key] = llc_nu
|
||||
return
|
||||
end
|
||||
|
||||
nu_state_src[src_key] = llc_nu
|
||||
if tonumber(last_nu) + 1 ~= tonumber(llc_nu) then
|
||||
print("JUMP in N(U) on TLLI " .. bssgp_ttli .. " and SAPI: " .. llc_sapi)
|
||||
print("\t last: " .. last_nu .. " now: " .. llc_nu)
|
||||
end
|
||||
end
|
||||
|
||||
function tap.draw()
|
||||
end
|
||||
|
||||
function tap.reset()
|
||||
end
|
||||
end
|
||||
init_listener()
|
||||
end
|
||||
|
Loading…
Reference in New Issue