The sent packet cannot be parsed by wireshark

[w910820618]

The sent packet cannot be parsed by wireshark, indicating that the length of the data in the data chunk in sctp is incorrect. I use sctp to send a package of ngap protocol that can be parsed by the server, but cannot be resolved by wireshark. After checking the normal package and the error package, I found that the sent packet was not the correct length and could not be parsed. I look at the sctp source code, it is necessary to set the length of the packet when sending the packet. But I didn't find a place to set the parameters in your sctp_send() method. client: `python import _sctp from sctp import from ngap import

import binascii

server = '127.0.0.1' sctpport = 2904

if _sctp.getconstant("IPPROTO_SCTP") != 132: raise ("getconstant failed") client_sock = sctpsocket(socket.AF_INET, socket.SOCK_STREAM, None) client_sock.set_sndbuf(10000) saddr = (server, sctpport)

print("SCTP", saddr, "------------------------------------------")

client_sock.initparams.max_instreams = 3 client_sock.initparams.num_ostreams = 3

client = server cport = 2901

caddr = (client, cport) client_sock.bindx([caddr]) client_sock.events.clear() client_sock.events.data_io = 1 client_sock.connect(saddr) PDU = NGAP_PDU_Descriptions.NGAP_PDU IEs = [] IEs.append({'id': 27, 'criticality': 'reject', 'value': ( 'GlobalRANNodeID', ('globalGNB-ID', {'pLMNIdentity': b'\x02\xf8\x98', 'gNB-ID': ('gNB-ID', (513, 32))}))} ) IEs.append({'id': 82, 'criticality': 'reject', 'value': ('RANNodeName', 'test gNB')} ) IEs.append({'id': 21, 'criticality': 'reject', 'value': ('PagingDRX', 'v128')}) IEs.append({'id': 102, 'criticality': 'reject', 'value': ('SupportedTAList', [{'tAC': b'\x01\x00\x01', 'broadcastPLMNList': [ {'pLMNIdentity': b'\x02\xf8\x98', 'tAISliceSupportList': [{ 's-NSSAI': { 'sST': b'\x01', 'sD': b'\x00\x00d'}}, { 's-NSSAI': { 'sST': b'\x02', 'sD': b'\x00\x00d'}}, { 's-NSSAI': { 'sST': b'\x03', 'sD': b'\x00\x00d'}}]}]}])} ) val = ( 'initiatingMessage', {'procedureCode': 21, 'criticality': 'reject', 'value': ('NGSetupRequest', {'protocolIEs': IEs})}) PDU.set_val(val) client_sock.sctp_send(PDU.to_aper()) fromaddr, flags, msg, notif = client_sock.sctp_recv(2048) print('%s__' % msg) print(client_sock.get_sndbuf()) server: python import socket import sctp from time import ctime from ngap import * from binascii import unhexlify

HOST = '' PORT = 2904 BUFSIZE = 2048 ADDR = (HOST, PORT)

socket_serv = sctp.sctpsocket(socket.AF_INET, socket.SOCK_STREAM, None) socket_serv.initparams.max_instreams = 3 socket_serv.initparams.num_ostreams = 3

socket_serv.bindx([ADDR]) socket_serv.listen(5) socket_serv.events.data_io = 1 socket_serv.events.clear() PDU = NGAP_PDU_Descriptions.NGAP_PDU

while True: print('Waiting for user connecting') conn_sock, addr = socket_serv.accept() print('connecting:', addr) msg = '' while True: fromaddr, flags, msg, notif = conn_sock.sctp_recv(maxlen=512) PDU.from_aper(msg) print(PDU.to_asn1())

    conn_sock.sctp_send(msg)
conn_sock.get_autoclose()

`

[p1-bmu]

pysctp is just a wrapper of the Linux kernel SCTP API. Generally, the parameter needed within functions and methods correspond to the parameters required by the kernel API. If something seems not encoded correctly when using it to send packet, you should check: 1) if you build the packet correctly 2) if you use the correct options of the SCTP socket, so that wireshark can decode the traffic automatically and correctly.

E.g. for 3GPP RAN protocol, in addition to the SCTP port number (NGAP is using SCTP/38412, not 2904 as you are using above), the payload protocol ID can also be important, (PPID is 60 for NGAP). You may also take care of the SCTP stream ID, depending of the type of signalling you are dealing with (e.g. UE associated or not).

You can have a look at the corenet SCTP server implementation: https://github.com/P1sec/pycrate/blob/acdcdfd3e47313ee9518894825161d405f90e503/pycrate_corenet/Server.py#L531

[w910820618]

thank you.