From 62009b9a43878ff22bc5f1a5e7d49743560a4743 Mon Sep 17 00:00:00 2001 From: gauthier <lionel.gauthier@eurecom.fr> Date: Fri, 16 Oct 2015 16:56:06 +0200 Subject: [PATCH] Sync for home --- .../attach_complete.pdml | 4242 +++++++++++++++++ .../enb.band7.tm1.usrpb210.epc.local.conf | 174 + openair3/TEST/EPC_TEST/generate_scenario.c | 339 +- openair3/TEST/EPC_TEST/generic_scenario.xsl | 46 + openair3/TEST/EPC_TEST/mme_test_s1_pcap2pdml | 24 +- 5 files changed, 4766 insertions(+), 59 deletions(-) create mode 100644 openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/attach_complete.pdml create mode 100644 openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/enb.band7.tm1.usrpb210.epc.local.conf create mode 100644 openair3/TEST/EPC_TEST/generic_scenario.xsl diff --git a/openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/attach_complete.pdml b/openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/attach_complete.pdml new file mode 100644 index 0000000000..fef45773f9 --- /dev/null +++ b/openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/attach_complete.pdml @@ -0,0 +1,4242 @@ +<?xml version="1.0" ?> +<?xml-stylesheet type="text/xsl" href="pdml2html.xsl"?> +<!-- You can find pdml2html.xsl in /usr/share/wireshark or at http://anonsvn.wireshark.org/trunk/wireshark/pdml2html.xsl. --> +<pdml capture_file="./attach_complete.pcapng" creator="wireshark/1.10.6" time="Wed Oct 14 15:33:08 2015" version="0"> + <packet> + <proto name="frame" pos="0" showname="Frame 9: 82 bytes on wire (656 bits), 82 bytes captured (656 bits) on interface 0" size="82"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.289149000" showname="Arrival Time: Sep 25, 2015 16:34:14.289149000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.289149000" showname="Epoch Time: 1443191654.289149000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="1.707367000" showname="Time delta from previous captured frame: 1.707367000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="1.707367000" showname="Time delta from previous displayed frame: 1.707367000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.823518000" showname="Time since reference or first frame: 7.823518000 seconds" size="0"/> + <field name="frame.number" pos="0" show="9" showname="Frame Number: 9" size="0"/> + <field name="frame.len" pos="0" show="82" showname="Frame Length: 82 bytes (656 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="82" showname="Capture Length: 82 bytes (656 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="68" showname="Total Length: 68" size="2" value="0044"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9ffd" showname="Header checksum: 0x9ffd [validation disabled]" size="2" value="9ffd"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9ffd"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9ffd"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="48"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x00000000" showname="Verification tag: 0x00000000" size="4" value="00000000"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xbbfe6088" showname="Checksum: 0xbbfe6088 (not verified)" size="4" value="bbfe6088"/> + <field name="" pos="46" show="INIT chunk (Outbound streams: 2, inbound streams: 2)" size="36" value="0100002454f837ab0001a00000020002c4fbb8d7000c00060005000080000004c0000004"> + <field name="sctp.chunk_type" pos="46" show="1" showname="Chunk type: INIT (1)" size="1" value="01"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="01" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="01" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="36" showname="Chunk length: 36" size="2" value="0024"/> + <field name="sctp.init_initiate_tag" pos="50" show="0x54f837ab" showname="Initiate tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.initiate_tag" pos="50" show="0x54f837ab" showname="Initiate tag: 0x54f837ab" size="4" value="54f837ab"/> + <field name="sctp.init_credit" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.init_nr_out_streams" pos="58" show="2" showname="Number of outbound streams: 2" size="2" value="0002"/> + <field name="sctp.init_nr_in_streams" pos="60" show="2" showname="Number of inbound streams: 2" size="2" value="0002"/> + <field name="sctp.init_initial_tsn" pos="62" show="3304831191" showname="Initial TSN: 3304831191" size="4" value="c4fbb8d7"/> + <field name="" pos="66" show="Supported address types parameter (Supported types: IPv4)" size="8" value="000c000600050000"> + <field name="sctp.parameter_type" pos="66" show="0x000c" showname="Parameter type: Supported address types (0x000c)" size="2" value="000c"> + <field name="sctp.parameter_bit_1" pos="66" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="000c" value="0"/> + <field name="sctp.parameter_bit_2" pos="66" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="000c" value="0"/> + </field> + <field name="sctp.parameter_length" pos="68" show="6" showname="Parameter length: 6" size="2" value="0006"/> + <field name="sctp.parameter_supported_addres_type" pos="70" show="5" showname="Supported address type: IPv4 address (5)" size="2" value="0005"/> + <field name="sctp.parameter_padding" pos="72" show="00:00" showname="Parameter padding: 0000" size="2" value="0000"/> + </field> + <field name="" pos="74" show="ECN parameter" size="4" value="80000004"> + <field name="sctp.parameter_type" pos="74" show="0x8000" showname="Parameter type: ECN (0x8000)" size="2" value="8000"> + <field name="sctp.parameter_bit_1" pos="74" show="1" showname="1... .... .... .... = Bit: Skip parameter and continue processing of the chunk" size="2" unmaskedvalue="8000" value="1"/> + <field name="sctp.parameter_bit_2" pos="74" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="8000" value="0"/> + </field> + <field name="sctp.parameter_length" pos="76" show="4" showname="Parameter length: 4" size="2" value="0004"/> + </field> + <field name="" pos="78" show="Forward TSN supported parameter" size="4" value="c0000004"> + <field name="sctp.parameter_type" pos="78" show="0xc000" showname="Parameter type: Forward TSN supported (0xc000)" size="2" value="c000"> + <field name="sctp.parameter_bit_1" pos="78" show="1" showname="1... .... .... .... = Bit: Skip parameter and continue processing of the chunk" size="2" unmaskedvalue="c000" value="1"/> + <field name="sctp.parameter_bit_2" pos="78" show="1" showname=".1.. .... .... .... = Bit: Do report" size="2" unmaskedvalue="c000" value="1"/> + </field> + <field name="sctp.parameter_length" pos="80" show="4" showname="Parameter length: 4" size="2" value="0004"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 10: 306 bytes on wire (2448 bits), 306 bytes captured (2448 bits) on interface 0" size="306"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.289229000" showname="Arrival Time: Sep 25, 2015 16:34:14.289229000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.289229000" showname="Epoch Time: 1443191654.289229000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000080000" showname="Time delta from previous captured frame: 0.000080000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000080000" showname="Time delta from previous displayed frame: 0.000080000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.823598000" showname="Time since reference or first frame: 7.823598000 seconds" size="0"/> + <field name="frame.number" pos="0" show="10" showname="Frame Number: 10" size="0"/> + <field name="frame.len" pos="0" show="306" showname="Frame Length: 306 bytes (2448 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="306" showname="Capture Length: 306 bytes (2448 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="292" showname="Total Length: 292" size="2" value="0124"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9f1d" showname="Header checksum: 0x9f1d [validation disabled]" size="2" value="9f1d"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9f1d"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9f1d"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="272"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xcf674bda" showname="Checksum: 0xcf674bda (not verified)" size="4" value="cf674bda"/> + <field name="" pos="46" show="INIT_ACK chunk (Outbound streams: 2, inbound streams: 2)" size="260" value="020001044cd1eca00001a0000002000277b42707000700e8d2e400842319c2ee3bf2eb94dff99192604ab35900000000000000000000000000000000a0ecd14cab37f85400000000000000000d425e07780c0000020002000727b47702008e3cc0a80cd500000000000000000000000000000000000000003c8e01000000000080020024efa851c90c104714b66409dff40a9f2d30a6e0b1be975e2eb1ee7d28f5b61aa90000000000000000000000000000000000000000000000000000000000000000000000000100002454f837ab0001a00000020002c4fbb8d7000c00060005000080000004c00000040000000000000000000000000000000080000004c0000004"> + <field name="sctp.chunk_type" pos="46" show="2" showname="Chunk type: INIT_ACK (2)" size="1" value="02"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="02" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="02" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="260" showname="Chunk length: 260" size="2" value="0104"/> + <field name="sctp.initack_initiate_tag" pos="50" show="0x4cd1eca0" showname="Initiate tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.initiate_tag" pos="50" show="0x4cd1eca0" showname="Initiate tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field name="sctp.initack_credit" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.initack_nr_out_streams" pos="58" show="2" showname="Number of outbound streams: 2" size="2" value="0002"/> + <field name="sctp.initack_nr_in_streams" pos="60" show="2" showname="Number of inbound streams: 2" size="2" value="0002"/> + <field name="sctp.initack_initial_tsn" pos="62" show="2008295175" showname="Initial TSN: 2008295175" size="4" value="77b42707"/> + <field name="" pos="66" show="State cookie parameter (Cookie length: 228 bytes)" size="232" value="000700e8d2e400842319c2ee3bf2eb94dff99192604ab35900000000000000000000000000000000a0ecd14cab37f85400000000000000000d425e07780c0000020002000727b47702008e3cc0a80cd500000000000000000000000000000000000000003c8e01000000000080020024efa851c90c104714b66409dff40a9f2d30a6e0b1be975e2eb1ee7d28f5b61aa90000000000000000000000000000000000000000000000000000000000000000000000000100002454f837ab0001a00000020002c4fbb8d7000c00060005000080000004c000000400000000000000000000000000000000"> + <field name="sctp.parameter_type" pos="66" show="0x0007" showname="Parameter type: State cookie (0x0007)" size="2" value="0007"> + <field name="sctp.parameter_bit_1" pos="66" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0007" value="0"/> + <field name="sctp.parameter_bit_2" pos="66" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0007" value="0"/> + </field> + <field name="sctp.parameter_length" pos="68" show="232" showname="Parameter length: 232" size="2" value="00e8"/> + <field name="sctp.parameter_state_cookie" pos="70" show="d2:e4:00:84:23:19:c2:ee:3b:f2:eb:94:df:f9:91:92:60:4a:b3:59:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:a0:ec:d1:4c:ab:37:f8:54:00:00:00:00:00:00:00:00:0d:42:5e:07:78:0c:00:00:02:00:02:00:07:27:b4:77:02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:3c:8e:01:00:00:00:00:00:80:02:00:24:ef:a8:51:c9:0c:10:47:14:b6:64:09:df:f4:0a:9f:2d:30:a6:e0:b1:be:97:5e:2e:b1:ee:7d:28:f5:b6:1a:a9:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:01:00:00:24:54:f8:37:ab:00:01:a0:00:00:02:00:02:c4:fb:b8:d7:00:0c:00:06:00:05:00:00:80:00:00:04:c0:00:00:04:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00" showname="State cookie: d2e400842319c2ee3bf2eb94dff99192604ab35900000000..." size="228" value="d2e400842319c2ee3bf2eb94dff99192604ab35900000000000000000000000000000000a0ecd14cab37f85400000000000000000d425e07780c0000020002000727b47702008e3cc0a80cd500000000000000000000000000000000000000003c8e01000000000080020024efa851c90c104714b66409dff40a9f2d30a6e0b1be975e2eb1ee7d28f5b61aa90000000000000000000000000000000000000000000000000000000000000000000000000100002454f837ab0001a00000020002c4fbb8d7000c00060005000080000004c000000400000000000000000000000000000000"/> + </field> + <field name="" pos="298" show="ECN parameter" size="4" value="80000004"> + <field name="sctp.parameter_type" pos="298" show="0x8000" showname="Parameter type: ECN (0x8000)" size="2" value="8000"> + <field name="sctp.parameter_bit_1" pos="298" show="1" showname="1... .... .... .... = Bit: Skip parameter and continue processing of the chunk" size="2" unmaskedvalue="8000" value="1"/> + <field name="sctp.parameter_bit_2" pos="298" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="8000" value="0"/> + </field> + <field name="sctp.parameter_length" pos="300" show="4" showname="Parameter length: 4" size="2" value="0004"/> + </field> + <field name="" pos="302" show="Forward TSN supported parameter" size="4" value="c0000004"> + <field name="sctp.parameter_type" pos="302" show="0xc000" showname="Parameter type: Forward TSN supported (0xc000)" size="2" value="c000"> + <field name="sctp.parameter_bit_1" pos="302" show="1" showname="1... .... .... .... = Bit: Skip parameter and continue processing of the chunk" size="2" unmaskedvalue="c000" value="1"/> + <field name="sctp.parameter_bit_2" pos="302" show="1" showname=".1.. .... .... .... = Bit: Do report" size="2" unmaskedvalue="c000" value="1"/> + </field> + <field name="sctp.parameter_length" pos="304" show="4" showname="Parameter length: 4" size="2" value="0004"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 11: 278 bytes on wire (2224 bits), 278 bytes captured (2224 bits) on interface 0" size="278"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.289649000" showname="Arrival Time: Sep 25, 2015 16:34:14.289649000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.289649000" showname="Epoch Time: 1443191654.289649000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000420000" showname="Time delta from previous captured frame: 0.000420000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000420000" showname="Time delta from previous displayed frame: 0.000420000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.824018000" showname="Time since reference or first frame: 7.824018000 seconds" size="0"/> + <field name="frame.number" pos="0" show="11" showname="Frame Number: 11" size="0"/> + <field name="frame.len" pos="0" show="278" showname="Frame Length: 278 bytes (2224 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="278" showname="Capture Length: 278 bytes (2224 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="264" showname="Total Length: 264" size="2" value="0108"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9f39" showname="Header checksum: 0x9f39 [validation disabled]" size="2" value="9f39"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9f39"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9f39"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="244"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x4056ad0d" showname="Checksum: 0x4056ad0d (not verified)" size="4" value="4056ad0d"/> + <field name="" pos="46" show="COOKIE_ECHO chunk (Cookie length: 228 bytes)" size="232" value="0a0000e8d2e400842319c2ee3bf2eb94dff99192604ab35900000000000000000000000000000000a0ecd14cab37f85400000000000000000d425e07780c0000020002000727b47702008e3cc0a80cd500000000000000000000000000000000000000003c8e01000000000080020024efa851c90c104714b66409dff40a9f2d30a6e0b1be975e2eb1ee7d28f5b61aa90000000000000000000000000000000000000000000000000000000000000000000000000100002454f837ab0001a00000020002c4fbb8d7000c00060005000080000004c000000400000000000000000000000000000000"> + <field name="sctp.chunk_type" pos="46" show="10" showname="Chunk type: COOKIE_ECHO (10)" size="1" value="0a"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="0a" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="0a" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="232" showname="Chunk length: 232" size="2" value="00e8"/> + <field name="sctp.cookie" pos="50" show="d2:e4:00:84:23:19:c2:ee:3b:f2:eb:94:df:f9:91:92:60:4a:b3:59:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:a0:ec:d1:4c:ab:37:f8:54:00:00:00:00:00:00:00:00:0d:42:5e:07:78:0c:00:00:02:00:02:00:07:27:b4:77:02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:3c:8e:01:00:00:00:00:00:80:02:00:24:ef:a8:51:c9:0c:10:47:14:b6:64:09:df:f4:0a:9f:2d:30:a6:e0:b1:be:97:5e:2e:b1:ee:7d:28:f5:b6:1a:a9:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:01:00:00:24:54:f8:37:ab:00:01:a0:00:00:02:00:02:c4:fb:b8:d7:00:0c:00:06:00:05:00:00:80:00:00:04:c0:00:00:04:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00" showname="Cookie: d2e400842319c2ee3bf2eb94dff99192604ab35900000000..." size="228" value="d2e400842319c2ee3bf2eb94dff99192604ab35900000000000000000000000000000000a0ecd14cab37f85400000000000000000d425e07780c0000020002000727b47702008e3cc0a80cd500000000000000000000000000000000000000003c8e01000000000080020024efa851c90c104714b66409dff40a9f2d30a6e0b1be975e2eb1ee7d28f5b61aa90000000000000000000000000000000000000000000000000000000000000000000000000100002454f837ab0001a00000020002c4fbb8d7000c00060005000080000004c000000400000000000000000000000000000000"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 12: 50 bytes on wire (400 bits), 50 bytes captured (400 bits) on interface 0" size="50"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.289704000" showname="Arrival Time: Sep 25, 2015 16:34:14.289704000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.289704000" showname="Epoch Time: 1443191654.289704000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000055000" showname="Time delta from previous captured frame: 0.000055000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000055000" showname="Time delta from previous displayed frame: 0.000055000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.824073000" showname="Time since reference or first frame: 7.824073000 seconds" size="0"/> + <field name="frame.number" pos="0" show="12" showname="Frame Number: 12" size="0"/> + <field name="frame.len" pos="0" show="50" showname="Frame Length: 50 bytes (400 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="50" showname="Capture Length: 50 bytes (400 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="36" showname="Total Length: 36" size="2" value="0024"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa01d" showname="Header checksum: 0xa01d [validation disabled]" size="2" value="a01d"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a01d"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a01d"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="16"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x629de6e0" showname="Checksum: 0x629de6e0 (not verified)" size="4" value="629de6e0"/> + <field name="" pos="46" show="COOKIE_ACK chunk" size="4" value="0b000004"> + <field name="sctp.chunk_type" pos="46" show="11" showname="Chunk type: COOKIE_ACK (11)" size="1" value="0b"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="0b" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="0b" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="4" showname="Chunk length: 4" size="2" value="0004"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 13: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) on interface 0" size="122"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.290056000" showname="Arrival Time: Sep 25, 2015 16:34:14.290056000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.290056000" showname="Epoch Time: 1443191654.290056000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000352000" showname="Time delta from previous captured frame: 0.000352000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000352000" showname="Time delta from previous displayed frame: 0.000352000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.824425000" showname="Time since reference or first frame: 7.824425000 seconds" size="0"/> + <field name="frame.number" pos="0" show="13" showname="Frame Number: 13" size="0"/> + <field name="frame.len" pos="0" show="122" showname="Frame Length: 122 bytes (976 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="122" showname="Capture Length: 122 bytes (976 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="108" showname="Total Length: 108" size="2" value="006c"/> + <field name="ip.id" pos="18" show="0x0001" showname="Identification: 0x0001 (1)" size="2" value="0001"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fd4" showname="Header checksum: 0x9fd4 [validation disabled]" size="2" value="9fd4"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fd4"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fd4"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x9981d0bb" showname="Checksum: 0x9981d0bb (not verified)" size="4" value="9981d0bb"/> + <field name="" pos="46" show="DATA chunk(ordered, complete segment, TSN: 3304831191, SID: 0, SSN: 0, PPID: 18, payload length: 59 bytes)" size="16" value="0003004bc4fbb8d70000000000000012"> + <field name="sctp.chunk_type" pos="46" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="47" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="47" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="47" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="47" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="75" showname="Chunk length: 75" size="2" value="004b"/> + <field name="sctp.data_tsn" pos="50" show="3304831191" showname="TSN: 3304831191" size="4" value="c4fbb8d7"/> + <field name="sctp.data_sid" pos="54" show="0x0000" showname="Stream Identifier: 0x0000" size="2" value="0000"/> + <field name="sctp.data_ssn" pos="56" show="0" showname="Stream sequence number: 0" size="2" value="0000"/> + <field name="sctp.data_payload_proto_id" pos="58" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + <field name="sctp.chunk_padding" pos="121" show="00" showname="Chunk padding: 00" size="1" value="00"/> + </field> + <proto name="s1ap" pos="62" showname="S1 Application Protocol" size="59"> + <field hide="yes" name="per.extension_bit" pos="62" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="62" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="62" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="59" value="00110037000004003b00080002f8590000e000003c40140880654e425f45757265636f6d5f4c5445426f78004000070000004002f8590089400140"> + <field name="s1ap.initiatingMessage" pos="62" show="" showname="initiatingMessage" size="59" value=""> + <field name="s1ap.procedureCode" pos="63" show="17" showname="procedureCode: id-S1Setup (17)" size="1" value="11"/> + <field hide="yes" name="per.enum_index" pos="64" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="64" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="65" show="55" showname="Open Type Length: 55" size="1" value="37"/> + <field name="s1ap.value" pos="66" show="" showname="value" size="55" value=""> + <field name="s1ap.S1SetupRequest" pos="66" show="" showname="S1SetupRequest" size="55" value=""> + <field hide="yes" name="per.extension_bit" pos="66" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="67" show="4" showname="Sequence-Of Length: 4" size="2" value="0004"/> + <field name="s1ap.protocolIEs" pos="69" show="4" showname="protocolIEs: 4 items" size="52" value="003b00080002f8590000e000003c40140880654e425f45757265636f6d5f4c5445426f78004000070000004002f8590089400140"> + <field name="" pos="69" show="Item 0: id-Global-ENB-ID" size="12" value="003b00080002f8590000e000"> + <field name="s1ap.ProtocolIE_Field" pos="69" show="" showname="ProtocolIE-Field" size="12" value=""> + <field name="s1ap.id" pos="69" show="59" showname="id: id-Global-ENB-ID (59)" size="2" value="003b"/> + <field hide="yes" name="per.enum_index" pos="71" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="71" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="72" show="8" showname="Open Type Length: 8" size="1" value="08"/> + <field name="s1ap.value" pos="73" show="" showname="value" size="8" value=""> + <field name="s1ap.Global_ENB_ID" pos="73" show="" showname="Global-ENB-ID" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="73" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="73" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="74" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="74" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="75" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field hide="yes" name="per.extension_bit" pos="77" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="77" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.eNB_ID" pos="77" show="0" showname="eNB-ID: macroENB-ID (0)" size="3" value="0000e0"> + <field name="s1ap.macroENB_ID" pos="77" show="00:e0:00" showname="macroENB-ID: 00e000 [bit length 20, 4 LSB pad bits, 0000 0000 1110 0000 0000 .... decimal value 3584]" size="3" value="00e000"/> + </field> + </field> + </field> + </field> + </field> + <field name="" pos="81" show="Item 1: id-eNBname" size="24" value="003c40140880654e425f45757265636f6d5f4c5445426f78"> + <field name="s1ap.ProtocolIE_Field" pos="81" show="" showname="ProtocolIE-Field" size="24" value=""> + <field name="s1ap.id" pos="81" show="60" showname="id: id-eNBname (60)" size="2" value="003c"/> + <field hide="yes" name="per.enum_index" pos="83" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="83" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="84" show="20" showname="Open Type Length: 20" size="1" value="14"/> + <field name="s1ap.value" pos="85" show="" showname="value" size="20" value=""> + <field name="per.extension_present_bit" pos="85" show="0" showname="0... .... Extension Present Bit: False" size="1" unmaskedvalue="08" value="0"/> + <field hide="yes" name="per.octet_string_length" pos="85" show="18" showname="Octet String Length: 18" size="1" value="08"/> + <field name="s1ap.ENBname" pos="87" show="eNB_Eurecom_LTEBox" showname="ENBname: eNB_Eurecom_LTEBox" size="18" value="654e425f45757265636f6d5f4c5445426f78"/> + </field> + </field> + </field> + <field name="" pos="105" show="Item 2: id-SupportedTAs" size="11" value="004000070000004002f859"> + <field name="s1ap.ProtocolIE_Field" pos="105" show="" showname="ProtocolIE-Field" size="11" value=""> + <field name="s1ap.id" pos="105" show="64" showname="id: id-SupportedTAs (64)" size="2" value="0040"/> + <field hide="yes" name="per.enum_index" pos="107" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="107" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="108" show="7" showname="Open Type Length: 7" size="1" value="07"/> + <field name="s1ap.value" pos="109" show="" showname="value" size="7" value=""> + <field hide="yes" name="per.sequence_of_length" pos="109" show="1" showname="Sequence-Of Length: 1" size="1" value="00"/> + <field name="s1ap.SupportedTAs" pos="110" show="1" showname="SupportedTAs: 1 item" size="6" value="00004002f859"> + <field name="" pos="110" show="Item 0" size="6" value="00004002f859"> + <field name="s1ap.SupportedTAs_Item" pos="110" show="" showname="SupportedTAs-Item" size="6" value=""> + <field hide="yes" name="per.extension_bit" pos="110" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="110" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.tAC" pos="110" show="00:01" showname="tAC: 0001" size="2" value="0001"/> + <field hide="yes" name="per.sequence_of_length" pos="112" show="1" showname="Sequence-Of Length: 1" size="1" value="40"/> + <field name="s1ap.broadcastPLMNs" pos="112" show="1" showname="broadcastPLMNs: 1 item" size="4" value="4002f859"> + <field name="" pos="112" show="Item 0" size="4" value="4002f859"> + <field name="s1ap.PLMNidentity" pos="113" show="02:f8:59" showname="PLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="113" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="114" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + <field name="" pos="116" show="Item 3: id-DefaultPagingDRX" size="5" value="0089400140"> + <field name="s1ap.ProtocolIE_Field" pos="116" show="" showname="ProtocolIE-Field" size="5" value=""> + <field name="s1ap.id" pos="116" show="137" showname="id: id-DefaultPagingDRX (137)" size="2" value="0089"/> + <field hide="yes" name="per.enum_index" pos="118" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="118" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="119" show="1" showname="Open Type Length: 1" size="1" value="01"/> + <field name="s1ap.value" pos="120" show="" showname="value" size="1" value=""> + <field hide="yes" name="per.extension_present_bit" pos="120" show="0" showname="0... .... Extension Present Bit: False" size="1" unmaskedvalue="40" value="0"/> + <field hide="yes" name="per.enum_index" pos="120" show="2" showname="Enumerated Index: 2" size="1" value="40"/> + <field name="s1ap.PagingDRX" pos="120" show="2" showname="PagingDRX: v128 (2)" size="1" value="40"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 14: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0" size="62"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.290087000" showname="Arrival Time: Sep 25, 2015 16:34:14.290087000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.290087000" showname="Epoch Time: 1443191654.290087000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000031000" showname="Time delta from previous captured frame: 0.000031000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000031000" showname="Time delta from previous displayed frame: 0.000031000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.824456000" showname="Time since reference or first frame: 7.824456000 seconds" size="0"/> + <field name="frame.number" pos="0" show="14" showname="Frame Number: 14" size="0"/> + <field name="frame.len" pos="0" show="62" showname="Frame Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="62" showname="Capture Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="48" showname="Total Length: 48" size="2" value="0030"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa011" showname="Header checksum: 0xa011 [validation disabled]" size="2" value="a011"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a011"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a011"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x1a9ba246" showname="Checksum: 0x1a9ba246 (not verified)" size="4" value="1a9ba246"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831191, a_rwnd: 106437, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8d700019fc500000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831191" showname="Cumulative TSN ACK: 3304831191" size="4" value="c4fbb8d7"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106437" showname="Advertised receiver window credit (a_rwnd): 106437" size="4" value="00019fc5"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 15: 114 bytes on wire (912 bits), 114 bytes captured (912 bits) on interface 0" size="114"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.290488000" showname="Arrival Time: Sep 25, 2015 16:34:14.290488000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.290488000" showname="Epoch Time: 1443191654.290488000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000401000" showname="Time delta from previous captured frame: 0.000401000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000401000" showname="Time delta from previous displayed frame: 0.000401000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.824857000" showname="Time since reference or first frame: 7.824857000 seconds" size="0"/> + <field name="frame.number" pos="0" show="15" showname="Frame Number: 15" size="0"/> + <field name="frame.len" pos="0" show="114" showname="Frame Length: 114 bytes (912 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="114" showname="Capture Length: 114 bytes (912 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="100" showname="Total Length: 100" size="2" value="0064"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fdd" showname="Header checksum: 0x9fdd [validation disabled]" size="2" value="9fdd"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fdd"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fdd"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x93a80c99" showname="Checksum: 0x93a80c99 (not verified)" size="4" value="93a80c99"/> + <field name="" pos="46" show="DATA chunk(ordered, complete segment, TSN: 2008295175, SID: 0, SSN: 0, PPID: 301989888, payload length: 49 bytes)" size="16" value="0003004177b427070000000012000000"> + <field name="sctp.chunk_type" pos="46" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="47" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="47" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="47" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="47" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="65" showname="Chunk length: 65" size="2" value="0041"/> + <field name="sctp.data_tsn" pos="50" show="2008295175" showname="TSN: 2008295175" size="4" value="77b42707"/> + <field name="sctp.data_sid" pos="54" show="0x0000" showname="Stream Identifier: 0x0000" size="2" value="0000"/> + <field name="sctp.data_ssn" pos="56" show="0" showname="Stream sequence number: 0" size="2" value="0000"/> + <field name="sctp.data_payload_proto_id" pos="58" show="301989888" showname="Payload protocol identifier: Unknown (301989888)" size="4" value="12000000"/> + <field name="sctp.chunk_padding" pos="111" show="00:00:00" showname="Chunk padding: 000000" size="3" value="000000"/> + </field> + <proto name="s1ap" pos="62" showname="S1 Application Protocol" size="49"> + <field hide="yes" name="per.extension_bit" pos="62" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="20" value="0"/> + <field hide="yes" name="per.choice_index" pos="62" show="1" showname="Choice Index: 1" size="1" value="20"/> + <field name="s1ap.S1AP_PDU" pos="62" show="1" showname="S1AP-PDU: successfulOutcome (1)" size="49" value="2011002d00000200690021000002f8590006800000040005001e00080009c3650a011e1f2021222324381d08005740010a"> + <field name="s1ap.successfulOutcome" pos="62" show="" showname="successfulOutcome" size="49" value=""> + <field name="s1ap.procedureCode" pos="63" show="17" showname="procedureCode: id-S1Setup (17)" size="1" value="11"/> + <field hide="yes" name="per.enum_index" pos="64" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="64" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="65" show="45" showname="Open Type Length: 45" size="1" value="2d"/> + <field name="s1ap.value" pos="66" show="" showname="value" size="45" value=""> + <field name="s1ap.S1SetupResponse" pos="66" show="" showname="S1SetupResponse" size="45" value=""> + <field hide="yes" name="per.extension_bit" pos="66" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="67" show="2" showname="Sequence-Of Length: 2" size="2" value="0002"/> + <field name="s1ap.protocolIEs" pos="69" show="2" showname="protocolIEs: 2 items" size="42" value="00690021000002f8590006800000040005001e00080009c3650a011e1f2021222324381d08005740010a"> + <field name="" pos="69" show="Item 0: id-ServedGUMMEIs" size="37" value="00690021000002f8590006800000040005001e00080009c3650a011e1f2021222324381d08"> + <field name="s1ap.ProtocolIE_Field" pos="69" show="" showname="ProtocolIE-Field" size="37" value=""> + <field name="s1ap.id" pos="69" show="105" showname="id: id-ServedGUMMEIs (105)" size="2" value="0069"/> + <field hide="yes" name="per.enum_index" pos="71" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="71" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="72" show="33" showname="Open Type Length: 33" size="1" value="21"/> + <field name="s1ap.value" pos="73" show="" showname="value" size="33" value=""> + <field hide="yes" name="per.sequence_of_length" pos="73" show="1" showname="Sequence-Of Length: 1" size="1" value="00"/> + <field name="s1ap.ServedGUMMEIs" pos="73" show="1" showname="ServedGUMMEIs: 1 item" size="33" value="000002f8590006800000040005001e00080009c3650a011e1f2021222324381d08"> + <field name="" pos="73" show="Item 0" size="33" value="000002f8590006800000040005001e00080009c3650a011e1f2021222324381d08"> + <field name="s1ap.ServedGUMMEIsItem" pos="73" show="" showname="ServedGUMMEIsItem" size="33" value=""> + <field hide="yes" name="per.extension_bit" pos="73" show="0" showname="...0 .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="73" show="0" showname=".... 0... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="73" show="1" showname="Sequence-Of Length: 1" size="1" value="00"/> + <field name="s1ap.servedPLMNs" pos="74" show="1" showname="servedPLMNs: 1 item" size="4" value="0002f859"> + <field name="" pos="74" show="Item 0" size="4" value="0002f859"> + <field name="s1ap.PLMNidentity" pos="75" show="02:f8:59" showname="PLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="75" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="76" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + </field> + </field> + <field hide="yes" name="per.sequence_of_length" pos="78" show="7" showname="Sequence-Of Length: 7" size="2" value="0006"/> + <field name="s1ap.servedGroupIDs" pos="80" show="7" showname="servedGroupIDs: 7 items" size="14" value="800000040005001e00080009c365"> + <field name="" pos="80" show="Item 0" size="2" value="8000"> + <field name="s1ap.MME_Group_ID" pos="80" show="80:00" showname="MME-Group-ID: 8000" size="2" value="8000"/> + </field> + <field name="" pos="82" show="Item 1" size="2" value="0004"> + <field name="s1ap.MME_Group_ID" pos="82" show="00:04" showname="MME-Group-ID: 0004" size="2" value="0004"/> + </field> + <field name="" pos="84" show="Item 2" size="2" value="0005"> + <field name="s1ap.MME_Group_ID" pos="84" show="00:05" showname="MME-Group-ID: 0005" size="2" value="0005"/> + </field> + <field name="" pos="86" show="Item 3" size="2" value="001e"> + <field name="s1ap.MME_Group_ID" pos="86" show="00:1e" showname="MME-Group-ID: 001e" size="2" value="001e"/> + </field> + <field name="" pos="88" show="Item 4" size="2" value="0008"> + <field name="s1ap.MME_Group_ID" pos="88" show="00:08" showname="MME-Group-ID: 0008" size="2" value="0008"/> + </field> + <field name="" pos="90" show="Item 5" size="2" value="0009"> + <field name="s1ap.MME_Group_ID" pos="90" show="00:09" showname="MME-Group-ID: 0009" size="2" value="0009"/> + </field> + <field name="" pos="92" show="Item 6" size="2" value="c365"> + <field name="s1ap.MME_Group_ID" pos="92" show="c3:65" showname="MME-Group-ID: c365" size="2" value="c365"/> + </field> + </field> + <field hide="yes" name="per.sequence_of_length" pos="94" show="11" showname="Sequence-Of Length: 11" size="1" value="0a"/> + <field name="s1ap.servedMMECs" pos="95" show="11" showname="servedMMECs: 11 items" size="11" value="011e1f2021222324381d08"> + <field name="" pos="95" show="Item 0" size="1" value="01"> + <field name="s1ap.MME_Code" pos="95" show="01" showname="MME-Code: 01" size="1" value="01"/> + </field> + <field name="" pos="96" show="Item 1" size="1" value="1e"> + <field name="s1ap.MME_Code" pos="96" show="1e" showname="MME-Code: 1e" size="1" value="1e"/> + </field> + <field name="" pos="97" show="Item 2" size="1" value="1f"> + <field name="s1ap.MME_Code" pos="97" show="1f" showname="MME-Code: 1f" size="1" value="1f"/> + </field> + <field name="" pos="98" show="Item 3" size="1" value="20"> + <field name="s1ap.MME_Code" pos="98" show="20" showname="MME-Code: 20" size="1" value="20"/> + </field> + <field name="" pos="99" show="Item 4" size="1" value="21"> + <field name="s1ap.MME_Code" pos="99" show="21" showname="MME-Code: 21" size="1" value="21"/> + </field> + <field name="" pos="100" show="Item 5" size="1" value="22"> + <field name="s1ap.MME_Code" pos="100" show="22" showname="MME-Code: 22" size="1" value="22"/> + </field> + <field name="" pos="101" show="Item 6" size="1" value="23"> + <field name="s1ap.MME_Code" pos="101" show="23" showname="MME-Code: 23" size="1" value="23"/> + </field> + <field name="" pos="102" show="Item 7" size="1" value="24"> + <field name="s1ap.MME_Code" pos="102" show="24" showname="MME-Code: 24" size="1" value="24"/> + </field> + <field name="" pos="103" show="Item 8" size="1" value="38"> + <field name="s1ap.MME_Code" pos="103" show="38" showname="MME-Code: 38" size="1" value="38"/> + </field> + <field name="" pos="104" show="Item 9" size="1" value="1d"> + <field name="s1ap.MME_Code" pos="104" show="1d" showname="MME-Code: 1d" size="1" value="1d"/> + </field> + <field name="" pos="105" show="Item 10" size="1" value="08"> + <field name="s1ap.MME_Code" pos="105" show="08" showname="MME-Code: 08" size="1" value="08"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + <field name="" pos="106" show="Item 1: id-RelativeMMECapacity" size="5" value="005740010a"> + <field name="s1ap.ProtocolIE_Field" pos="106" show="" showname="ProtocolIE-Field" size="5" value=""> + <field name="s1ap.id" pos="106" show="87" showname="id: id-RelativeMMECapacity (87)" size="2" value="0057"/> + <field hide="yes" name="per.enum_index" pos="108" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="108" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="109" show="1" showname="Open Type Length: 1" size="1" value="01"/> + <field name="s1ap.value" pos="110" show="" showname="value" size="1" value=""> + <field name="s1ap.RelativeMMECapacity" pos="110" show="10" showname="RelativeMMECapacity: 10" size="1" value="0a"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 16: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0" size="62"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:14.290617000" showname="Arrival Time: Sep 25, 2015 16:34:14.290617000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191654.290617000" showname="Epoch Time: 1443191654.290617000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000129000" showname="Time delta from previous captured frame: 0.000129000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000129000" showname="Time delta from previous displayed frame: 0.000129000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="7.824986000" showname="Time since reference or first frame: 7.824986000 seconds" size="0"/> + <field name="frame.number" pos="0" show="16" showname="Frame Number: 16" size="0"/> + <field name="frame.len" pos="0" show="62" showname="Frame Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="62" showname="Capture Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="48" showname="Total Length: 48" size="2" value="0030"/> + <field name="ip.id" pos="18" show="0x0002" showname="Identification: 0x0002 (2)" size="2" value="0002"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa00f" showname="Header checksum: 0xa00f [validation disabled]" size="2" value="a00f"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a00f"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a00f"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x7385d3c3" showname="Checksum: 0x7385d3c3 (not verified)" size="4" value="7385d3c3"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 2008295175, a_rwnd: 106447, gaps: 0, duplicate TSNs: 0)" size="16" value="0300001077b4270700019fcf00000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="2008295175" showname="Cumulative TSN ACK: 2008295175" size="4" value="77b42707"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106447" showname="Advertised receiver window credit (a_rwnd): 106447" size="4" value="00019fcf"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 56: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:46.604468000" showname="Arrival Time: Sep 25, 2015 16:34:46.604468000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191686.604468000" showname="Epoch Time: 1443191686.604468000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.112851000" showname="Time delta from previous captured frame: 0.112851000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.112851000" showname="Time delta from previous displayed frame: 0.112851000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="40.138837000" showname="Time since reference or first frame: 40.138837000 seconds" size="0"/> + <field name="frame.number" pos="0" show="56" showname="Frame Number: 56" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0003" showname="Identification: 0x0003 (3)" size="2" value="0003"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fea" showname="Header checksum: 0x9fea [validation disabled]" size="2" value="9fea"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fea"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fea"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x0a5b2e92" showname="Checksum: 0x0a5b2e92 (not verified)" size="4" value="0a5b2e92"/> + <field name="" pos="46" show="HEARTBEAT chunk (Information: 48 bytes)" size="52" value="040000340001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180932214010000007730e920aa62f65b"> + <field name="sctp.chunk_type" pos="46" show="4" showname="Chunk type: HEARTBEAT (4)" size="1" value="04"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="04" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="04" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180932214010000007730e920aa62f65b"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:11:00:00:00:00:00:00:00:00:00:74:59:d1:00:88:ff:ff:1e:20:1d:81:80:93:22:14:01:00:00:00:77:30:e9:20:aa:62:f6:5b" showname="Heartbeat information: 02008e3cc0a80c110000000000000000007459d10088ffff..." size="44" value="02008e3cc0a80c110000000000000000007459d10088ffff1e201d8180932214010000007730e920aa62f65b"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 57: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:46.604504000" showname="Arrival Time: Sep 25, 2015 16:34:46.604504000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191686.604504000" showname="Epoch Time: 1443191686.604504000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000036000" showname="Time delta from previous captured frame: 0.000036000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000036000" showname="Time delta from previous displayed frame: 0.000036000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="40.138873000" showname="Time since reference or first frame: 40.138873000 seconds" size="0"/> + <field name="frame.number" pos="0" show="57" showname="Frame Number: 57" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fed" showname="Header checksum: 0x9fed [validation disabled]" size="2" value="9fed"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fed"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fed"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x388245ea" showname="Checksum: 0x388245ea (not verified)" size="4" value="388245ea"/> + <field name="" pos="46" show="HEARTBEAT_ACK chunk (Information: 48 bytes)" size="52" value="050000340001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180932214010000007730e920aa62f65b"> + <field name="sctp.chunk_type" pos="46" show="5" showname="Chunk type: HEARTBEAT_ACK (5)" size="1" value="05"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="05" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="05" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180932214010000007730e920aa62f65b"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:11:00:00:00:00:00:00:00:00:00:74:59:d1:00:88:ff:ff:1e:20:1d:81:80:93:22:14:01:00:00:00:77:30:e9:20:aa:62:f6:5b" showname="Heartbeat information: 02008e3cc0a80c110000000000000000007459d10088ffff..." size="44" value="02008e3cc0a80c110000000000000000007459d10088ffff1e201d8180932214010000007730e920aa62f65b"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 60: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:47.154133000" showname="Arrival Time: Sep 25, 2015 16:34:47.154133000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191687.154133000" showname="Epoch Time: 1443191687.154133000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.500903000" showname="Time delta from previous captured frame: 0.500903000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.500903000" showname="Time delta from previous displayed frame: 0.500903000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="40.688502000" showname="Time since reference or first frame: 40.688502000 seconds" size="0"/> + <field name="frame.number" pos="0" show="60" showname="Frame Number: 60" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fed" showname="Header checksum: 0x9fed [validation disabled]" size="2" value="9fed"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fed"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fed"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x3ecfdb18" showname="Checksum: 0x3ecfdb18 (not verified)" size="4" value="3ecfdb18"/> + <field name="" pos="46" show="HEARTBEAT chunk (Information: 48 bytes)" size="52" value="040000340001003002008e3cc0a80cd50000000000000000000000000000000000000000e00c3300010000008db53fb930a0b65f"> + <field name="sctp.chunk_type" pos="46" show="4" showname="Chunk type: HEARTBEAT (4)" size="1" value="04"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="04" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="04" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80cd50000000000000000000000000000000000000000e00c3300010000008db53fb930a0b65f"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:e0:0c:33:00:01:00:00:00:8d:b5:3f:b9:30:a0:b6:5f" showname="Heartbeat information: 02008e3cc0a80cd500000000000000000000000000000000..." size="44" value="02008e3cc0a80cd50000000000000000000000000000000000000000e00c3300010000008db53fb930a0b65f"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 61: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:47.154270000" showname="Arrival Time: Sep 25, 2015 16:34:47.154270000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191687.154270000" showname="Epoch Time: 1443191687.154270000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000137000" showname="Time delta from previous captured frame: 0.000137000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000137000" showname="Time delta from previous displayed frame: 0.000137000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="40.688639000" showname="Time since reference or first frame: 40.688639000 seconds" size="0"/> + <field name="frame.number" pos="0" show="61" showname="Frame Number: 61" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0004" showname="Identification: 0x0004 (4)" size="2" value="0004"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fe9" showname="Header checksum: 0x9fe9 [validation disabled]" size="2" value="9fe9"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fe9"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fe9"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x0c16b060" showname="Checksum: 0x0c16b060 (not verified)" size="4" value="0c16b060"/> + <field name="" pos="46" show="HEARTBEAT_ACK chunk (Information: 48 bytes)" size="52" value="050000340001003002008e3cc0a80cd50000000000000000000000000000000000000000e00c3300010000008db53fb930a0b65f"> + <field name="sctp.chunk_type" pos="46" show="5" showname="Chunk type: HEARTBEAT_ACK (5)" size="1" value="05"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="05" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="05" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80cd50000000000000000000000000000000000000000e00c3300010000008db53fb930a0b65f"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:e0:0c:33:00:01:00:00:00:8d:b5:3f:b9:30:a0:b6:5f" showname="Heartbeat information: 02008e3cc0a80cd500000000000000000000000000000000..." size="44" value="02008e3cc0a80cd50000000000000000000000000000000000000000e00c3300010000008db53fb930a0b65f"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 76: 186 bytes on wire (1488 bits), 186 bytes captured (1488 bits) on interface 0" size="186"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.748321000" showname="Arrival Time: Sep 25, 2015 16:34:53.748321000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.748321000" showname="Epoch Time: 1443191693.748321000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="1.074002000" showname="Time delta from previous captured frame: 1.074002000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="1.074002000" showname="Time delta from previous displayed frame: 1.074002000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.282690000" showname="Time since reference or first frame: 47.282690000 seconds" size="0"/> + <field name="frame.number" pos="0" show="76" showname="Frame Number: 76" size="0"/> + <field name="frame.len" pos="0" show="186" showname="Frame Length: 186 bytes (1488 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="186" showname="Capture Length: 186 bytes (1488 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:nas-eps:ipcp:s1ap:s1ap:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:nas-eps:ipcp:s1ap:s1ap:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="172" showname="Total Length: 172" size="2" value="00ac"/> + <field name="ip.id" pos="18" show="0x0005" showname="Identification: 0x0005 (5)" size="2" value="0005"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9f90" showname="Header checksum: 0x9f90 [validation disabled]" size="2" value="9f90"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9f90"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9f90"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x47f403e8" showname="Checksum: 0x47f403e8 (not verified)" size="4" value="47f403e8"/> + <field name="" pos="46" show="DATA chunk(ordered, complete segment, TSN: 3304831192, SID: 1, SSN: 0, PPID: 18, payload length: 122 bytes)" size="16" value="0003008ac4fbb8d80001000000000012"> + <field name="sctp.chunk_type" pos="46" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="47" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="47" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="47" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="47" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="138" showname="Chunk length: 138" size="2" value="008a"/> + <field name="sctp.data_tsn" pos="50" show="3304831192" showname="TSN: 3304831192" size="4" value="c4fbb8d8"/> + <field name="sctp.data_sid" pos="54" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="56" show="0" showname="Stream sequence number: 0" size="2" value="0000"/> + <field name="sctp.data_payload_proto_id" pos="58" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + <field name="sctp.chunk_padding" pos="184" show="00:00" showname="Chunk padding: 0000" size="2" value="0000"/> + </field> + <proto name="s1ap" pos="62" showname="S1 Application Protocol" size="122"> + <field hide="yes" name="per.extension_bit" pos="62" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="62" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="62" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="122" value="000c0076000006000800048006692d001a00414017c4dba6bb020741010bf602f8598000016c00092002e0e000200201d011271a8080211001000010810600000000830600000000000d00000a005202f8590001004300060002f8590001006440080002f85900e000000086400130004b000700000000800001"> + <field name="s1ap.initiatingMessage" pos="62" show="" showname="initiatingMessage" size="122" value=""> + <field name="s1ap.procedureCode" pos="63" show="12" showname="procedureCode: id-initialUEMessage (12)" size="1" value="0c"/> + <field hide="yes" name="per.enum_index" pos="64" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="64" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="65" show="118" showname="Open Type Length: 118" size="1" value="76"/> + <field name="s1ap.value" pos="66" show="" showname="value" size="118" value=""> + <field name="s1ap.InitialUEMessage" pos="66" show="" showname="InitialUEMessage" size="118" value=""> + <field hide="yes" name="per.extension_bit" pos="66" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="67" show="6" showname="Sequence-Of Length: 6" size="2" value="0006"/> + <field name="s1ap.protocolIEs" pos="69" show="6" showname="protocolIEs: 6 items" size="115" value="000800048006692d001a00414017c4dba6bb020741010bf602f8598000016c00092002e0e000200201d011271a8080211001000010810600000000830600000000000d00000a005202f8590001004300060002f8590001006440080002f85900e000000086400130004b000700000000800001"> + <field name="" pos="69" show="Item 0: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="69" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="69" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="71" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="71" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="72" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="73" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="73" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="77" show="Item 1: id-NAS-PDU" size="69" value="001a00414017c4dba6bb020741010bf602f8598000016c00092002e0e000200201d011271a8080211001000010810600000000830600000000000d00000a005202f8590001"> + <field name="s1ap.ProtocolIE_Field" pos="77" show="" showname="ProtocolIE-Field" size="69" value=""> + <field name="s1ap.id" pos="77" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="79" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="79" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="80" show="65" showname="Open Type Length: 65" size="1" value="41"/> + <field name="s1ap.value" pos="81" show="" showname="value" size="65" value=""> + <field hide="yes" name="per.octet_string_length" pos="81" show="64" showname="Octet String Length: 64" size="1" value="40"/> + <field name="s1ap.NAS_PDU" pos="82" show="17:c4:db:a6:bb:02:07:41:01:0b:f6:02:f8:59:80:00:01:6c:00:09:20:02:e0:e0:00:20:02:01:d0:11:27:1a:80:80:21:10:01:00:00:10:81:06:00:00:00:00:83:06:00:00:00:00:00:0d:00:00:0a:00:52:02:f8:59:00:01" showname="NAS-PDU: 17c4dba6bb020741010bf602f8598000016c00092002e0e0..." size="64" value="17c4dba6bb020741010bf602f8598000016c00092002e0e000200201d011271a8080211001000010810600000000830600000000000d00000a005202f8590001"/> + <proto name="nas-eps" pos="82" showname="Non-Access-Stratum (NAS)PDU" size="64"> + <field name="nas_eps.security_header_type" pos="82" show="1" showname="0001 .... = Security header type: Integrity protected (1)" size="1" unmaskedvalue="17" value="1"/> + <field name="gsm_a.L3_protocol_discriminator" pos="82" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="17" value="7"/> + <field name="nas_eps.msg_auth_code" pos="83" show="0xc4dba6bb" showname="Message authentication code: 0xc4dba6bb" size="4" value="c4dba6bb"/> + <field name="nas_eps.seq_no" pos="87" show="2" showname="Sequence number: 2" size="1" value="02"/> + <field name="nas_eps.security_header_type" pos="88" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="88" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="89" show="0x41" showname="NAS EPS Mobility Management Message Type: Attach request (0x41)" size="1" value="41"/> + <field name="nas_eps.emm.tsc" pos="90" show="0" showname="0... .... = Type of security context flag (TSC): Native security context (for KSIasme)" size="1" value="01"/> + <field name="nas_eps.emm.nas_key_set_id" pos="90" show="0" showname=".000 .... = NAS key set identifier: (0)" size="1" value="01"/> + <field name="nas_eps.spare_bits" pos="90" show="0x00" showname=".... 0... = Spare bit(s): 0x00" size="1" value="01"/> + <field name="nas_eps.emm.eps_att_type" pos="90" show="1" showname=".... .001 = EPS attach type: EPS attach (1)" size="1" value="01"/> + <field name="" pos="91" show="EPS mobile identity" size="12" value="0bf602f8598000016c000920"> + <field name="gsm_a.len" pos="91" show="11" showname="Length: 11" size="1" value="0b"/> + <field name="nas_eps.emm.odd_even" pos="92" show="0" showname=".... 0... = odd/even indic: 0" size="1" unmaskedvalue="f6" value="0"/> + <field name="nas_eps.emm.type_of_id" pos="92" show="6" showname=".... .110 = Type of identity: GUTI (6)" size="1" unmaskedvalue="f6" value="6"/> + <field name="e212.mcc" pos="93" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="94" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="nas_eps.emm.mme_grp_id" pos="96" show="32768" showname="MME Group ID: 32768" size="2" value="8000"/> + <field name="nas_eps.emm.mme_code" pos="98" show="1" showname="MME Code: 1" size="1" value="01"/> + <field name="nas_eps.emm.m_tmsi" pos="99" show="0x6c000920" showname="M-TMSI: 0x6c000920" size="4" value="6c000920"/> + </field> + <field name="" pos="103" show="UE network capability" size="3" value="02e0e0"> + <field name="gsm_a.len" pos="103" show="2" showname="Length: 2" size="1" value="02"/> + <field name="nas_eps.emm.eea0" pos="104" show="1" showname="1... .... = EEA0: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eea1" pos="104" show="1" showname=".1.. .... = 128-EEA1: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eea2" pos="104" show="1" showname="..1. .... = 128-EEA2: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.eea3" pos="104" show="0" showname="...0 .... = 128-EEA3: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea4" pos="104" show="0" showname=".... 0... = EEA4: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea5" pos="104" show="0" showname=".... .0.. = EEA5: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea6" pos="104" show="0" showname=".... ..0. = EEA6: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea7" pos="104" show="0" showname=".... ...0 = EEA7: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia0" pos="105" show="1" showname="1... .... = EIA0: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eia1" pos="105" show="1" showname=".1.. .... = 128-EIA1: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eia2" pos="105" show="1" showname="..1. .... = 128-EIA2: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.eia3" pos="105" show="0" showname="...0 .... = 128-EIA3: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia4" pos="105" show="0" showname=".... 0... = EIA4: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia5" pos="105" show="0" showname=".... .0.. = EIA5: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia6" pos="105" show="0" showname=".... ..0. = EIA6: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia7" pos="105" show="0" showname=".... ...0 = EIA7: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + </field> + <field name="" pos="106" show="ESM message container" size="34" value="00200201d011271a8080211001000010810600000000830600000000000d00000a00"> + <field name="gsm_a.len" pos="106" show="32" showname="Length: 32" size="2" value="0020"/> + <field name="nas_eps.emm.esm_msg_cont" pos="108" show="02:01:d0:11:27:1a:80:80:21:10:01:00:00:10:81:06:00:00:00:00:83:06:00:00:00:00:00:0d:00:00:0a:00" showname="ESM message container contents: 0201d011271a808021100100001081060000000083060000..." size="32" value="0201d011271a8080211001000010810600000000830600000000000d00000a00"> + <field name="nas_eps.bearer_id" pos="108" show="0" showname="0000 .... = EPS bearer identity: No EPS bearer identity assigned (0)" size="1" unmaskedvalue="02" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="108" show="0x02" showname=".... 0010 = Protocol discriminator: EPS session management messages (0x02)" size="1" unmaskedvalue="02" value="2"/> + <field name="nas_eps.esm.proc_trans_id" pos="109" show="1" showname="Procedure transaction identity: 1" size="1" value="01"/> + <field name="nas_eps.nas_msg_esm_type" pos="110" show="0xd0" showname="NAS EPS session management messages: PDN connectivity request (0xd0)" size="1" value="d0"/> + <field name="nas_eps.esm_pdn_type" pos="111" show="1" showname="0001 .... = PDN type: IPv4 (1)" size="1" value="11"/> + <field name="nas_eps.esm_request_type" pos="111" show="1" showname=".... 0001 = Request type: initial request (1)" size="1" value="11"/> + <field name="" pos="112" show="Protocol Configuration Options" size="28" value="271a8080211001000010810600000000830600000000000d00000a00"> + <field name="gsm_a.gm.elem_id" pos="112" show="0x27" showname="Element ID: 0x27" size="1" value="27"/> + <field name="gsm_a.len" pos="113" show="26" showname="Length: 26" size="1" value="1a"/> + <field name="gsm_a.gm.sm.link_dir" pos="114" show="0" showname="Link direction: MS to network (0)" size="0"/> + <field name="gsm_a.gm.sm.ext" pos="114" show="1" showname="1... .... = Extension: True" size="1" unmaskedvalue="80" value="1"/> + <field name="" pos="114" show="Configuration Protocol: PPP for use with IP PDP type or IP PDN type (0)" size="1" value="80"/> + <field name="gsm_a.gm.sm.pco_pid" pos="115" show="32801" showname="Protocol or Container ID: Internet Protocol Control Protocol (0x8021)" size="2" value="8021"> + <field name="" pos="117" show="Length: 0x10 (16)" size="1" value="10"/> + <proto name="ipcp" pos="118" showname="PPP IP Control Protocol" size="16"> + <field name="ppp.code" pos="118" show="1" showname="Code: Configuration Request (1)" size="1" value="01"/> + <field name="ppp.identifier" pos="119" show="0" showname="Identifier: 0 (0x00)" size="1" value="00"/> + <field name="ppp.length" pos="120" show="16" showname="Length: 16" size="2" value="0010"/> + <field name="" pos="122" show="Options: (12 bytes), Primary DNS Server IP Address, Secondary DNS Server IP Address" size="12" value="810600000000830600000000"> + <field name="" pos="122" show="Primary DNS Server IP Address: 0.0.0.0" size="6" value="810600000000"> + <field name="ipcp.opt.type" pos="122" show="129" showname="Type: Primary DNS Server IP Address (129)" size="1" value="81"/> + <field name="ipcp.opt.length" pos="123" show="6" showname="Length: 6" size="1" value="06"/> + <field name="ipcp.opt.pri_dns_address" pos="124" show="0.0.0.0" showname="Primary DNS Address: 0.0.0.0 (0.0.0.0)" size="4" value="00000000"/> + </field> + <field name="" pos="128" show="Secondary DNS Server IP Address: 0.0.0.0" size="6" value="830600000000"> + <field name="ipcp.opt.type" pos="128" show="131" showname="Type: Secondary DNS Server IP Address (131)" size="1" value="83"/> + <field name="ipcp.opt.length" pos="129" show="6" showname="Length: 6" size="1" value="06"/> + <field name="ipcp.opt.sec_dns_address" pos="130" show="0.0.0.0" showname="Secondary DNS Address: 0.0.0.0 (0.0.0.0)" size="4" value="00000000"/> + </field> + </field> + </proto> + </field> + <field name="gsm_a.gm.sm.pco_pid" pos="134" show="13" showname="Protocol or Container ID: DNS Server IPv4 Address Request (0x000d)" size="2" value="000d"> + <field name="" pos="136" show="Length: 0x00 (0)" size="1" value="00"/> + </field> + <field name="gsm_a.gm.sm.pco_pid" pos="137" show="10" showname="Protocol or Container ID: IP address allocation via NAS signalling (0x000a)" size="2" value="000a"> + <field name="" pos="139" show="Length: 0x00 (0)" size="1" value="00"/> + </field> + </field> + </field> + </field> + <field name="" pos="140" show="Tracking area identity - Last visited registered TAI" size="6" value="5202f8590001"> + <field name="nas_eps.emm.elem_id" pos="140" show="0x52" showname="Element ID: 0x52" size="1" value="52"/> + <field name="e212.mcc" pos="141" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="142" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="nas_eps.emm.tai_tac" pos="144" show="0x0001" showname="Tracking area code(TAC): 0x0001" size="2" value="0001"/> + </field> + </proto> + </field> + </field> + </field> + <field name="" pos="146" show="Item 2: id-TAI" size="10" value="004300060002f8590001"> + <field name="s1ap.ProtocolIE_Field" pos="146" show="" showname="ProtocolIE-Field" size="10" value=""> + <field name="s1ap.id" pos="146" show="67" showname="id: id-TAI (67)" size="2" value="0043"/> + <field hide="yes" name="per.enum_index" pos="148" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="148" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="149" show="6" showname="Open Type Length: 6" size="1" value="06"/> + <field name="s1ap.value" pos="150" show="" showname="value" size="6" value=""> + <field name="s1ap.TAI" pos="150" show="" showname="TAI" size="6" value=""> + <field hide="yes" name="per.extension_bit" pos="150" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="150" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="151" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="151" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="152" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.tAC" pos="154" show="00:01" showname="tAC: 0001" size="2" value="0001"/> + </field> + </field> + </field> + </field> + <field name="" pos="156" show="Item 3: id-EUTRAN-CGI" size="12" value="006440080002f85900e00000"> + <field name="s1ap.ProtocolIE_Field" pos="156" show="" showname="ProtocolIE-Field" size="12" value=""> + <field name="s1ap.id" pos="156" show="100" showname="id: id-EUTRAN-CGI (100)" size="2" value="0064"/> + <field hide="yes" name="per.enum_index" pos="158" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="158" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="159" show="8" showname="Open Type Length: 8" size="1" value="08"/> + <field name="s1ap.value" pos="160" show="" showname="value" size="8" value=""> + <field name="s1ap.EUTRAN_CGI" pos="160" show="" showname="EUTRAN-CGI" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="160" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="160" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="161" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="161" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="162" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.cell_ID" pos="160" show="00:e0:00:00" showname="cell-ID: 00e00000 [bit length 28, 4 LSB pad bits, 0000 0000 1110 0000 0000 0000 0000 .... decimal value 917504]" size="4" value="00e00000"/> + </field> + </field> + </field> + </field> + <field name="" pos="168" show="Item 4: id-RRC-Establishment-Cause" size="5" value="0086400130"> + <field name="s1ap.ProtocolIE_Field" pos="168" show="" showname="ProtocolIE-Field" size="5" value=""> + <field name="s1ap.id" pos="168" show="134" showname="id: id-RRC-Establishment-Cause (134)" size="2" value="0086"/> + <field hide="yes" name="per.enum_index" pos="170" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="170" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="171" show="1" showname="Open Type Length: 1" size="1" value="01"/> + <field name="s1ap.value" pos="172" show="" showname="value" size="1" value=""> + <field hide="yes" name="per.extension_present_bit" pos="172" show="0" showname="0... .... Extension Present Bit: False" size="1" unmaskedvalue="30" value="0"/> + <field hide="yes" name="per.enum_index" pos="172" show="3" showname="Enumerated Index: 3" size="1" value="30"/> + <field name="s1ap.RRC_Establishment_Cause" pos="172" show="3" showname="RRC-Establishment-Cause: mo-Signalling (3)" size="1" value="30"/> + </field> + </field> + </field> + <field name="" pos="173" show="Item 5: id-GUMMEI-ID" size="11" value="004b000700000000800001"> + <field name="s1ap.ProtocolIE_Field" pos="173" show="" showname="ProtocolIE-Field" size="11" value=""> + <field name="s1ap.id" pos="173" show="75" showname="id: id-GUMMEI-ID (75)" size="2" value="004b"/> + <field hide="yes" name="per.enum_index" pos="175" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="175" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="176" show="7" showname="Open Type Length: 7" size="1" value="07"/> + <field name="s1ap.value" pos="177" show="" showname="value" size="7" value=""> + <field name="s1ap.GUMMEI" pos="177" show="" showname="GUMMEI" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="177" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="177" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMN_Identity" pos="178" show="00:00:00" showname="pLMN-Identity: 000000" size="3" value="000000"/> + <field name="e212.mcc" pos="178" show="0" showname="Mobile Country Code (MCC): Unknown (0)" size="2" value="0000"/> + <field name="e212.mnc" pos="179" show="0" showname="Mobile Network Code (MNC): Unknown (000)" size="2" value="0000"/> + <field name="s1ap.mME_Group_ID" pos="181" show="80:00" showname="mME-Group-ID: 8000" size="2" value="8000"/> + <field name="s1ap.mME_Code" pos="183" show="01" showname="mME-Code: 01" size="1" value="01"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 77: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) on interface 0" size="110"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.749945000" showname="Arrival Time: Sep 25, 2015 16:34:53.749945000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.749945000" showname="Epoch Time: 1443191693.749945000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.001624000" showname="Time delta from previous captured frame: 0.001624000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.001624000" showname="Time delta from previous displayed frame: 0.001624000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.284314000" showname="Time since reference or first frame: 47.284314000 seconds" size="0"/> + <field name="frame.number" pos="0" show="77" showname="Frame Number: 77" size="0"/> + <field name="frame.len" pos="0" show="110" showname="Frame Length: 110 bytes (880 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="110" showname="Capture Length: 110 bytes (880 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="96" showname="Total Length: 96" size="2" value="0060"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fe1" showname="Header checksum: 0x9fe1 [validation disabled]" size="2" value="9fe1"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fe1"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fe1"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x69f9ecaa" showname="Checksum: 0x69f9ecaa (not verified)" size="4" value="69f9ecaa"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831192, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8d80001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831192" showname="Cumulative TSN ACK: 3304831192" size="4" value="c4fbb8d8"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 2008295176, SID: 1, SSN: 0, PPID: 301989888, payload length: 32 bytes)" size="16" value="0003003077b427080001000012000000"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="48" showname="Chunk length: 48" size="2" value="0030"/> + <field name="sctp.data_tsn" pos="66" show="2008295176" showname="TSN: 2008295176" size="4" value="77b42708"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="0" showname="Stream sequence number: 0" size="2" value="0000"/> + <field name="sctp.data_payload_proto_id" pos="74" show="301989888" showname="Payload protocol identifier: Unknown (301989888)" size="4" value="12000000"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="32"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="32" value="000b001c00000300000005c0740010d0000800048006692d001a000403075501"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="32" value=""> + <field name="s1ap.procedureCode" pos="79" show="11" showname="procedureCode: id-downlinkNASTransport (11)" size="1" value="0b"/> + <field hide="yes" name="per.enum_index" pos="80" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="80" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="81" show="28" showname="Open Type Length: 28" size="1" value="1c"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="28" value=""> + <field name="s1ap.DownlinkNASTransport" pos="82" show="" showname="DownlinkNASTransport" size="28" value=""> + <field hide="yes" name="per.extension_bit" pos="82" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="83" show="3" showname="Sequence-Of Length: 3" size="2" value="0003"/> + <field name="s1ap.protocolIEs" pos="85" show="3" showname="protocolIEs: 3 items" size="25" value="00000005c0740010d0000800048006692d001a000403075501"> + <field name="" pos="85" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="85" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="85" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="87" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="87" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="88" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="89" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="89" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="94" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="94" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="94" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="96" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="96" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="97" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="98" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="98" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="102" show="Item 2: id-NAS-PDU" size="8" value="001a000403075501"> + <field name="s1ap.ProtocolIE_Field" pos="102" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="102" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="104" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="104" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="105" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="106" show="" showname="value" size="4" value=""> + <field hide="yes" name="per.octet_string_length" pos="106" show="3" showname="Octet String Length: 3" size="1" value="03"/> + <field name="s1ap.NAS_PDU" pos="107" show="07:55:01" showname="NAS-PDU: 075501" size="3" value="075501"/> + <proto name="nas-eps" pos="107" showname="Non-Access-Stratum (NAS)PDU" size="3"> + <field name="nas_eps.security_header_type" pos="107" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="107" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="108" show="0x55" showname="NAS EPS Mobility Management Message Type: Identity request (0x55)" size="1" value="55"/> + <field name="nas_eps.emm.spare_half_octet" pos="109" show="0" showname="0000 .... = Spare half octet: 0" size="1" value="01"/> + <field name="nas_eps.emm.id_type2" pos="109" show="1" showname=".... 0001 = Identity type 2: IMSI (1)" size="1" value="01"/> + </proto> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 78: 146 bytes on wire (1168 bits), 146 bytes captured (1168 bits) on interface 0" size="146"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.767126000" showname="Arrival Time: Sep 25, 2015 16:34:53.767126000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.767126000" showname="Epoch Time: 1443191693.767126000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.017181000" showname="Time delta from previous captured frame: 0.017181000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.017181000" showname="Time delta from previous displayed frame: 0.017181000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.301495000" showname="Time since reference or first frame: 47.301495000 seconds" size="0"/> + <field name="frame.number" pos="0" show="78" showname="Frame Number: 78" size="0"/> + <field name="frame.len" pos="0" show="146" showname="Frame Length: 146 bytes (1168 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="146" showname="Capture Length: 146 bytes (1168 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="132" showname="Total Length: 132" size="2" value="0084"/> + <field name="ip.id" pos="18" show="0x0006" showname="Identification: 0x0006 (6)" size="2" value="0006"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fb7" showname="Header checksum: 0x9fb7 [validation disabled]" size="2" value="9fb7"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fb7"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fb7"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x6cae2fa5" showname="Checksum: 0x6cae2fa5 (not verified)" size="4" value="6cae2fa5"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 2008295176, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="0300001077b427080001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="2008295176" showname="Cumulative TSN ACK: 2008295176" size="4" value="77b42708"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 3304831193, SID: 1, SSN: 1, PPID: 18, payload length: 68 bytes)" size="16" value="00030054c4fbb8d90001000100000012"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="84" showname="Chunk length: 84" size="2" value="0054"/> + <field name="sctp.data_tsn" pos="66" show="3304831193" showname="TSN: 3304831193" size="4" value="c4fbb8d9"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="1" showname="Stream sequence number: 1" size="2" value="0001"/> + <field name="sctp.data_payload_proto_id" pos="74" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="68"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="68" value="000d404000000500000005c0740010d0000800048006692d001a00121117b3e0e284030756082980590000000020006440080002f85900e00000004340060002f8590001"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="68" value=""> + <field name="s1ap.procedureCode" pos="79" show="13" showname="procedureCode: id-uplinkNASTransport (13)" size="1" value="0d"/> + <field hide="yes" name="per.enum_index" pos="80" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="80" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="81" show="64" showname="Open Type Length: 64" size="1" value="40"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="64" value=""> + <field name="s1ap.UplinkNASTransport" pos="82" show="" showname="UplinkNASTransport" size="64" value=""> + <field hide="yes" name="per.extension_bit" pos="82" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="83" show="5" showname="Sequence-Of Length: 5" size="2" value="0005"/> + <field name="s1ap.protocolIEs" pos="85" show="5" showname="protocolIEs: 5 items" size="61" value="00000005c0740010d0000800048006692d001a00121117b3e0e284030756082980590000000020006440080002f85900e00000004340060002f8590001"> + <field name="" pos="85" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="85" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="85" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="87" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="87" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="88" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="89" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="89" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="94" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="94" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="94" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="96" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="96" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="97" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="98" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="98" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="102" show="Item 2: id-NAS-PDU" size="22" value="001a00121117b3e0e284030756082980590000000020"> + <field name="s1ap.ProtocolIE_Field" pos="102" show="" showname="ProtocolIE-Field" size="22" value=""> + <field name="s1ap.id" pos="102" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="104" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="104" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="105" show="18" showname="Open Type Length: 18" size="1" value="12"/> + <field name="s1ap.value" pos="106" show="" showname="value" size="18" value=""> + <field hide="yes" name="per.octet_string_length" pos="106" show="17" showname="Octet String Length: 17" size="1" value="11"/> + <field name="s1ap.NAS_PDU" pos="107" show="17:b3:e0:e2:84:03:07:56:08:29:80:59:00:00:00:00:20" showname="NAS-PDU: 17b3e0e284030756082980590000000020" size="17" value="17b3e0e284030756082980590000000020"/> + <proto name="nas-eps" pos="107" showname="Non-Access-Stratum (NAS)PDU" size="17"> + <field name="nas_eps.security_header_type" pos="107" show="1" showname="0001 .... = Security header type: Integrity protected (1)" size="1" unmaskedvalue="17" value="1"/> + <field name="gsm_a.L3_protocol_discriminator" pos="107" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="17" value="7"/> + <field name="nas_eps.msg_auth_code" pos="108" show="0xb3e0e284" showname="Message authentication code: 0xb3e0e284" size="4" value="b3e0e284"/> + <field name="nas_eps.seq_no" pos="112" show="3" showname="Sequence number: 3" size="1" value="03"/> + <field name="nas_eps.security_header_type" pos="113" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="113" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="114" show="0x56" showname="NAS EPS Mobility Management Message Type: Identity response (0x56)" size="1" value="56"/> + <field name="" pos="115" show="Mobile identity - IMSI (208950000000002)" size="9" value="082980590000000020"> + <field name="gsm_a.len" pos="115" show="8" showname="Length: 8" size="1" value="08"/> + <field name="" pos="116" show="0010 .... = Identity Digit 1: 2" size="1" value="29"/> + <field name="gsm_a.oddevenind" pos="116" show="1" showname=".... 1... = Odd/even indication: Odd number of identity digits" size="1" unmaskedvalue="29" value="1"/> + <field name="gsm_a.ie.mobileid.type" pos="116" show="1" showname=".... .001 = Mobile Identity Type: IMSI (1)" size="1" unmaskedvalue="29" value="1"/> + <field name="gsm_a.imsi" pos="116" show="208950000000002" showname="BCD Digits: 208950000000002" size="8" value="2980590000000020"/> + </field> + </proto> + </field> + </field> + </field> + <field name="" pos="124" show="Item 3: id-EUTRAN-CGI" size="12" value="006440080002f85900e00000"> + <field name="s1ap.ProtocolIE_Field" pos="124" show="" showname="ProtocolIE-Field" size="12" value=""> + <field name="s1ap.id" pos="124" show="100" showname="id: id-EUTRAN-CGI (100)" size="2" value="0064"/> + <field hide="yes" name="per.enum_index" pos="126" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="126" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="127" show="8" showname="Open Type Length: 8" size="1" value="08"/> + <field name="s1ap.value" pos="128" show="" showname="value" size="8" value=""> + <field name="s1ap.EUTRAN_CGI" pos="128" show="" showname="EUTRAN-CGI" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="128" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="128" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="129" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="129" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="130" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.cell_ID" pos="128" show="00:e0:00:00" showname="cell-ID: 00e00000 [bit length 28, 4 LSB pad bits, 0000 0000 1110 0000 0000 0000 0000 .... decimal value 917504]" size="4" value="00e00000"/> + </field> + </field> + </field> + </field> + <field name="" pos="136" show="Item 4: id-TAI" size="10" value="004340060002f8590001"> + <field name="s1ap.ProtocolIE_Field" pos="136" show="" showname="ProtocolIE-Field" size="10" value=""> + <field name="s1ap.id" pos="136" show="67" showname="id: id-TAI (67)" size="2" value="0043"/> + <field hide="yes" name="per.enum_index" pos="138" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="138" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="139" show="6" showname="Open Type Length: 6" size="1" value="06"/> + <field name="s1ap.value" pos="140" show="" showname="value" size="6" value=""> + <field name="s1ap.TAI" pos="140" show="" showname="TAI" size="6" value=""> + <field hide="yes" name="per.extension_bit" pos="140" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="140" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="141" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="141" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="142" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.tAC" pos="144" show="00:01" showname="tAC: 0001" size="2" value="0001"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 79: 146 bytes on wire (1168 bits), 146 bytes captured (1168 bits) on interface 0" size="146"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.771623000" showname="Arrival Time: Sep 25, 2015 16:34:53.771623000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.771623000" showname="Epoch Time: 1443191693.771623000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.004497000" showname="Time delta from previous captured frame: 0.004497000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.004497000" showname="Time delta from previous displayed frame: 0.004497000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.305992000" showname="Time since reference or first frame: 47.305992000 seconds" size="0"/> + <field name="frame.number" pos="0" show="79" showname="Frame Number: 79" size="0"/> + <field name="frame.len" pos="0" show="146" showname="Frame Length: 146 bytes (1168 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="146" showname="Capture Length: 146 bytes (1168 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="132" showname="Total Length: 132" size="2" value="0084"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fbd" showname="Header checksum: 0x9fbd [validation disabled]" size="2" value="9fbd"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fbd"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fbd"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xf61432bc" showname="Checksum: 0xf61432bc (not verified)" size="4" value="f61432bc"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831193, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8d90001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831193" showname="Cumulative TSN ACK: 3304831193" size="4" value="c4fbb8d9"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 2008295177, SID: 1, SSN: 1, PPID: 301989888, payload length: 65 bytes)" size="16" value="0003005177b427090001000112000000"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="81" showname="Chunk length: 81" size="2" value="0051"/> + <field name="sctp.data_tsn" pos="66" show="2008295177" showname="TSN: 2008295177" size="4" value="77b42709"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="1" showname="Stream sequence number: 1" size="2" value="0001"/> + <field name="sctp.data_payload_proto_id" pos="74" show="301989888" showname="Payload protocol identifier: Unknown (301989888)" size="4" value="12000000"/> + <field name="sctp.chunk_padding" pos="143" show="00:00:00" showname="Chunk padding: 000000" size="3" value="000000"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="65"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="65" value="000b003d00000300000005c0740010d0000800048006692d001a00252407520007cefaf5dd90a76da30d2c6775f4e41f10a19ee7945f198000a2a656d4988ff528"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="65" value=""> + <field name="s1ap.procedureCode" pos="79" show="11" showname="procedureCode: id-downlinkNASTransport (11)" size="1" value="0b"/> + <field hide="yes" name="per.enum_index" pos="80" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="80" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="81" show="61" showname="Open Type Length: 61" size="1" value="3d"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="61" value=""> + <field name="s1ap.DownlinkNASTransport" pos="82" show="" showname="DownlinkNASTransport" size="61" value=""> + <field hide="yes" name="per.extension_bit" pos="82" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="83" show="3" showname="Sequence-Of Length: 3" size="2" value="0003"/> + <field name="s1ap.protocolIEs" pos="85" show="3" showname="protocolIEs: 3 items" size="58" value="00000005c0740010d0000800048006692d001a00252407520007cefaf5dd90a76da30d2c6775f4e41f10a19ee7945f198000a2a656d4988ff528"> + <field name="" pos="85" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="85" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="85" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="87" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="87" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="88" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="89" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="89" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="94" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="94" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="94" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="96" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="96" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="97" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="98" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="98" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="102" show="Item 2: id-NAS-PDU" size="41" value="001a00252407520007cefaf5dd90a76da30d2c6775f4e41f10a19ee7945f198000a2a656d4988ff528"> + <field name="s1ap.ProtocolIE_Field" pos="102" show="" showname="ProtocolIE-Field" size="41" value=""> + <field name="s1ap.id" pos="102" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="104" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="104" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="105" show="37" showname="Open Type Length: 37" size="1" value="25"/> + <field name="s1ap.value" pos="106" show="" showname="value" size="37" value=""> + <field hide="yes" name="per.octet_string_length" pos="106" show="36" showname="Octet String Length: 36" size="1" value="24"/> + <field name="s1ap.NAS_PDU" pos="107" show="07:52:00:07:ce:fa:f5:dd:90:a7:6d:a3:0d:2c:67:75:f4:e4:1f:10:a1:9e:e7:94:5f:19:80:00:a2:a6:56:d4:98:8f:f5:28" showname="NAS-PDU: 07520007cefaf5dd90a76da30d2c6775f4e41f10a19ee794..." size="36" value="07520007cefaf5dd90a76da30d2c6775f4e41f10a19ee7945f198000a2a656d4988ff528"/> + <proto name="nas-eps" pos="107" showname="Non-Access-Stratum (NAS)PDU" size="36"> + <field name="nas_eps.security_header_type" pos="107" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="107" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="108" show="0x52" showname="NAS EPS Mobility Management Message Type: Authentication request (0x52)" size="1" value="52"/> + <field name="nas_eps.emm.spare_half_octet" pos="109" show="0" showname="0000 .... = Spare half octet: 0" size="1" value="00"/> + <field name="nas_eps.emm.tsc" pos="109" show="0" showname=".... 0... = Type of security context flag (TSC): Native security context (for KSIasme)" size="1" value="00"/> + <field name="nas_eps.emm.nas_key_set_id" pos="109" show="0" showname=".... .000 = NAS key set identifier: (0) ASME" size="1" value="00"/> + <field name="" pos="110" show="Authentication Parameter RAND - EPS challenge" size="16" value="07cefaf5dd90a76da30d2c6775f4e41f"> + <field name="gsm_a.dtap.rand" pos="110" show="07:ce:fa:f5:dd:90:a7:6d:a3:0d:2c:67:75:f4:e4:1f" showname="RAND value: 07cefaf5dd90a76da30d2c6775f4e41f" size="16" value="07cefaf5dd90a76da30d2c6775f4e41f"/> + </field> + <field name="" pos="126" show="Authentication Parameter AUTN (UMTS and EPS authentication challenge) - EPS challenge" size="17" value="10a19ee7945f198000a2a656d4988ff528"> + <field name="gsm_a.len" pos="126" show="16" showname="Length: 16" size="1" value="10"/> + <field name="gsm_a.dtap.autn" pos="127" show="a1:9e:e7:94:5f:19:80:00:a2:a6:56:d4:98:8f:f5:28" showname="AUTN value: a19ee7945f198000a2a656d4988ff528" size="16" value="a19ee7945f198000a2a656d4988ff528"> + <field name="gsm_a.dtap.autn.sqn_xor_ak" pos="127" show="a1:9e:e7:94:5f:19" showname="SQN xor AK: a19ee7945f19" size="6" value="a19ee7945f19"/> + <field name="gsm_a.dtap.autn.amf" pos="133" show="80:00" showname="AMF: 8000" size="2" value="8000"/> + <field name="gsm_a.dtap.autn.mac" pos="135" show="a2:a6:56:d4:98:8f:f5:28" showname="MAC: a2a656d4988ff528" size="8" value="a2a656d4988ff528"/> + </field> + </field> + </proto> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 80: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0" size="62"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.971568000" showname="Arrival Time: Sep 25, 2015 16:34:53.971568000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.971568000" showname="Epoch Time: 1443191693.971568000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.199945000" showname="Time delta from previous captured frame: 0.199945000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.199945000" showname="Time delta from previous displayed frame: 0.199945000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.505937000" showname="Time since reference or first frame: 47.505937000 seconds" size="0"/> + <field name="frame.number" pos="0" show="80" showname="Frame Number: 80" size="0"/> + <field name="frame.len" pos="0" show="62" showname="Frame Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="62" showname="Capture Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="48" showname="Total Length: 48" size="2" value="0030"/> + <field name="ip.id" pos="18" show="0x0007" showname="Identification: 0x0007 (7)" size="2" value="0007"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa00a" showname="Header checksum: 0xa00a [validation disabled]" size="2" value="a00a"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a00a"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a00a"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x9017abdf" showname="Checksum: 0x9017abdf (not verified)" size="4" value="9017abdf"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 2008295177, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="0300001077b427090001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="2008295177" showname="Cumulative TSN ACK: 2008295177" size="4" value="77b42709"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 81: 130 bytes on wire (1040 bits), 130 bytes captured (1040 bits) on interface 0" size="130"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.977130000" showname="Arrival Time: Sep 25, 2015 16:34:53.977130000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.977130000" showname="Epoch Time: 1443191693.977130000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.005562000" showname="Time delta from previous captured frame: 0.005562000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.005562000" showname="Time delta from previous displayed frame: 0.005562000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.511499000" showname="Time since reference or first frame: 47.511499000 seconds" size="0"/> + <field name="frame.number" pos="0" show="81" showname="Frame Number: 81" size="0"/> + <field name="frame.len" pos="0" show="130" showname="Frame Length: 130 bytes (1040 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="130" showname="Capture Length: 130 bytes (1040 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="116" showname="Total Length: 116" size="2" value="0074"/> + <field name="ip.id" pos="18" show="0x0008" showname="Identification: 0x0008 (8)" size="2" value="0008"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fc5" showname="Header checksum: 0x9fc5 [validation disabled]" size="2" value="9fc5"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fc5"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fc5"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x2fbe8f7d" showname="Checksum: 0x2fbe8f7d (not verified)" size="4" value="2fbe8f7d"/> + <field name="" pos="46" show="DATA chunk(ordered, complete segment, TSN: 3304831194, SID: 1, SSN: 2, PPID: 18, payload length: 68 bytes)" size="16" value="00030054c4fbb8da0001000200000012"> + <field name="sctp.chunk_type" pos="46" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="47" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="47" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="47" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="47" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="84" showname="Chunk length: 84" size="2" value="0054"/> + <field name="sctp.data_tsn" pos="50" show="3304831194" showname="TSN: 3304831194" size="4" value="c4fbb8da"/> + <field name="sctp.data_sid" pos="54" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="56" show="2" showname="Stream sequence number: 2" size="2" value="0002"/> + <field name="sctp.data_payload_proto_id" pos="58" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + </field> + <proto name="s1ap" pos="62" showname="S1 Application Protocol" size="68"> + <field hide="yes" name="per.extension_bit" pos="62" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="62" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="62" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="68" value="000d404000000500000005c0740010d0000800048006692d001a00121117aecd82eb0407530829a497732efc0114006440080002f85900e00000004340060002f8590001"> + <field name="s1ap.initiatingMessage" pos="62" show="" showname="initiatingMessage" size="68" value=""> + <field name="s1ap.procedureCode" pos="63" show="13" showname="procedureCode: id-uplinkNASTransport (13)" size="1" value="0d"/> + <field hide="yes" name="per.enum_index" pos="64" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="64" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="65" show="64" showname="Open Type Length: 64" size="1" value="40"/> + <field name="s1ap.value" pos="66" show="" showname="value" size="64" value=""> + <field name="s1ap.UplinkNASTransport" pos="66" show="" showname="UplinkNASTransport" size="64" value=""> + <field hide="yes" name="per.extension_bit" pos="66" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="67" show="5" showname="Sequence-Of Length: 5" size="2" value="0005"/> + <field name="s1ap.protocolIEs" pos="69" show="5" showname="protocolIEs: 5 items" size="61" value="00000005c0740010d0000800048006692d001a00121117aecd82eb0407530829a497732efc0114006440080002f85900e00000004340060002f8590001"> + <field name="" pos="69" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="69" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="69" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="71" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="71" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="72" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="73" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="73" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="78" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="78" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="78" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="80" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="80" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="81" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="82" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="86" show="Item 2: id-NAS-PDU" size="22" value="001a00121117aecd82eb0407530829a497732efc0114"> + <field name="s1ap.ProtocolIE_Field" pos="86" show="" showname="ProtocolIE-Field" size="22" value=""> + <field name="s1ap.id" pos="86" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="88" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="88" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="89" show="18" showname="Open Type Length: 18" size="1" value="12"/> + <field name="s1ap.value" pos="90" show="" showname="value" size="18" value=""> + <field hide="yes" name="per.octet_string_length" pos="90" show="17" showname="Octet String Length: 17" size="1" value="11"/> + <field name="s1ap.NAS_PDU" pos="91" show="17:ae:cd:82:eb:04:07:53:08:29:a4:97:73:2e:fc:01:14" showname="NAS-PDU: 17aecd82eb0407530829a497732efc0114" size="17" value="17aecd82eb0407530829a497732efc0114"/> + <proto name="nas-eps" pos="91" showname="Non-Access-Stratum (NAS)PDU" size="17"> + <field name="nas_eps.security_header_type" pos="91" show="1" showname="0001 .... = Security header type: Integrity protected (1)" size="1" unmaskedvalue="17" value="1"/> + <field name="gsm_a.L3_protocol_discriminator" pos="91" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="17" value="7"/> + <field name="nas_eps.msg_auth_code" pos="92" show="0xaecd82eb" showname="Message authentication code: 0xaecd82eb" size="4" value="aecd82eb"/> + <field name="nas_eps.seq_no" pos="96" show="4" showname="Sequence number: 4" size="1" value="04"/> + <field name="nas_eps.security_header_type" pos="97" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="97" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="98" show="0x53" showname="NAS EPS Mobility Management Message Type: Authentication response (0x53)" size="1" value="53"/> + <field name="" pos="99" show="Authentication response parameter" size="9" value="0829a497732efc0114"> + <field name="gsm_a.len" pos="99" show="8" showname="Length: 8" size="1" value="08"/> + <field name="nas_eps.emm.res" pos="100" show="29:a4:97:73:2e:fc:01:14" showname="RES: 29a497732efc0114" size="8" value="29a497732efc0114"/> + </field> + </proto> + </field> + </field> + </field> + <field name="" pos="108" show="Item 3: id-EUTRAN-CGI" size="12" value="006440080002f85900e00000"> + <field name="s1ap.ProtocolIE_Field" pos="108" show="" showname="ProtocolIE-Field" size="12" value=""> + <field name="s1ap.id" pos="108" show="100" showname="id: id-EUTRAN-CGI (100)" size="2" value="0064"/> + <field hide="yes" name="per.enum_index" pos="110" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="110" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="111" show="8" showname="Open Type Length: 8" size="1" value="08"/> + <field name="s1ap.value" pos="112" show="" showname="value" size="8" value=""> + <field name="s1ap.EUTRAN_CGI" pos="112" show="" showname="EUTRAN-CGI" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="112" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="112" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="113" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="113" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="114" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.cell_ID" pos="112" show="00:e0:00:00" showname="cell-ID: 00e00000 [bit length 28, 4 LSB pad bits, 0000 0000 1110 0000 0000 0000 0000 .... decimal value 917504]" size="4" value="00e00000"/> + </field> + </field> + </field> + </field> + <field name="" pos="120" show="Item 4: id-TAI" size="10" value="004340060002f8590001"> + <field name="s1ap.ProtocolIE_Field" pos="120" show="" showname="ProtocolIE-Field" size="10" value=""> + <field name="s1ap.id" pos="120" show="67" showname="id: id-TAI (67)" size="2" value="0043"/> + <field hide="yes" name="per.enum_index" pos="122" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="122" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="123" show="6" showname="Open Type Length: 6" size="1" value="06"/> + <field name="s1ap.value" pos="124" show="" showname="value" size="6" value=""> + <field name="s1ap.TAI" pos="124" show="" showname="TAI" size="6" value=""> + <field hide="yes" name="per.extension_bit" pos="124" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="124" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="125" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="125" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="126" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.tAC" pos="128" show="00:01" showname="tAC: 0001" size="2" value="0001"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 82: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) on interface 0" size="122"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.978741000" showname="Arrival Time: Sep 25, 2015 16:34:53.978741000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.978741000" showname="Epoch Time: 1443191693.978741000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.001611000" showname="Time delta from previous captured frame: 0.001611000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.001611000" showname="Time delta from previous displayed frame: 0.001611000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.513110000" showname="Time since reference or first frame: 47.513110000 seconds" size="0"/> + <field name="frame.number" pos="0" show="82" showname="Frame Number: 82" size="0"/> + <field name="frame.len" pos="0" show="122" showname="Frame Length: 122 bytes (976 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="122" showname="Capture Length: 122 bytes (976 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="108" showname="Total Length: 108" size="2" value="006c"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fd5" showname="Header checksum: 0x9fd5 [validation disabled]" size="2" value="9fd5"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fd5"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fd5"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x5c01fd01" showname="Checksum: 0x5c01fd01 (not verified)" size="4" value="5c01fd01"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831194, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8da0001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831194" showname="Cumulative TSN ACK: 3304831194" size="4" value="c4fbb8da"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 2008295178, SID: 1, SSN: 2, PPID: 301989888, payload length: 42 bytes)" size="16" value="0003003a77b4270a0001000212000000"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="58" showname="Chunk length: 58" size="2" value="003a"/> + <field name="sctp.data_tsn" pos="66" show="2008295178" showname="TSN: 2008295178" size="4" value="77b4270a"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="2" showname="Stream sequence number: 2" size="2" value="0002"/> + <field name="sctp.data_payload_proto_id" pos="74" show="301989888" showname="Payload protocol identifier: Unknown (301989888)" size="4" value="12000000"/> + <field name="sctp.chunk_padding" pos="120" show="00:00" showname="Chunk padding: 0000" size="2" value="0000"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="42"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="42" value="000b002600000300000005c0740010d0000800048006692d001a000e0d376566048700075d020002e0e0"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="42" value=""> + <field name="s1ap.procedureCode" pos="79" show="11" showname="procedureCode: id-downlinkNASTransport (11)" size="1" value="0b"/> + <field hide="yes" name="per.enum_index" pos="80" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="80" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="81" show="38" showname="Open Type Length: 38" size="1" value="26"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="38" value=""> + <field name="s1ap.DownlinkNASTransport" pos="82" show="" showname="DownlinkNASTransport" size="38" value=""> + <field hide="yes" name="per.extension_bit" pos="82" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="83" show="3" showname="Sequence-Of Length: 3" size="2" value="0003"/> + <field name="s1ap.protocolIEs" pos="85" show="3" showname="protocolIEs: 3 items" size="35" value="00000005c0740010d0000800048006692d001a000e0d376566048700075d020002e0e0"> + <field name="" pos="85" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="85" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="85" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="87" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="87" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="88" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="89" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="89" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="94" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="94" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="94" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="96" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="96" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="97" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="98" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="98" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="102" show="Item 2: id-NAS-PDU" size="18" value="001a000e0d376566048700075d020002e0e0"> + <field name="s1ap.ProtocolIE_Field" pos="102" show="" showname="ProtocolIE-Field" size="18" value=""> + <field name="s1ap.id" pos="102" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="104" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="104" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="105" show="14" showname="Open Type Length: 14" size="1" value="0e"/> + <field name="s1ap.value" pos="106" show="" showname="value" size="14" value=""> + <field hide="yes" name="per.octet_string_length" pos="106" show="13" showname="Octet String Length: 13" size="1" value="0d"/> + <field name="s1ap.NAS_PDU" pos="107" show="37:65:66:04:87:00:07:5d:02:00:02:e0:e0" showname="NAS-PDU: 376566048700075d020002e0e0" size="13" value="376566048700075d020002e0e0"/> + <proto name="nas-eps" pos="107" showname="Non-Access-Stratum (NAS)PDU" size="13"> + <field name="nas_eps.security_header_type" pos="107" show="3" showname="0011 .... = Security header type: Integrity protected with new EPS security context (3)" size="1" unmaskedvalue="37" value="3"/> + <field name="gsm_a.L3_protocol_discriminator" pos="107" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="37" value="7"/> + <field name="nas_eps.msg_auth_code" pos="108" show="0x65660487" showname="Message authentication code: 0x65660487" size="4" value="65660487"/> + <field name="nas_eps.seq_no" pos="112" show="0" showname="Sequence number: 0" size="1" value="00"/> + <field name="nas_eps.security_header_type" pos="113" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="113" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="114" show="0x5d" showname="NAS EPS Mobility Management Message Type: Security mode command (0x5d)" size="1" value="5d"/> + <field name="" pos="115" show="NAS security algorithms - Selected NAS security algorithms" size="1" value="02"> + <field name="nas_eps.spare_bits" pos="115" show="0x00" showname="0... .... = Spare bit(s): 0x00" size="1" value="02"/> + <field name="nas_eps.emm.toc" pos="115" show="0" showname=".000 .... = Type of ciphering algorithm: EPS encryption algorithm EEA0 (null ciphering algorithm) (0)" size="1" unmaskedvalue="02" value="0"/> + <field name="nas_eps.spare_bits" pos="115" show="0x00" showname=".... 0... = Spare bit(s): 0x00" size="1" value="02"/> + <field name="nas_eps.emm.toi" pos="115" show="2" showname=".... .010 = Type of integrity protection algorithm: EPS integrity algorithm 128-EIA2 (2)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="nas_eps.emm.spare_half_octet" pos="116" show="0" showname="0000 .... = Spare half octet: 0" size="1" value="00"/> + <field name="nas_eps.emm.tsc" pos="116" show="0" showname=".... 0... = Type of security context flag (TSC): Native security context (for KSIasme)" size="1" value="00"/> + <field name="nas_eps.emm.nas_key_set_id" pos="116" show="0" showname=".... .000 = NAS key set identifier: (0) ASME" size="1" value="00"/> + <field name="" pos="117" show="UE security capability - Replayed UE security capabilities" size="3" value="02e0e0"> + <field name="gsm_a.len" pos="117" show="2" showname="Length: 2" size="1" value="02"/> + <field name="nas_eps.emm.eea0" pos="118" show="1" showname="1... .... = EEA0: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eea1" pos="118" show="1" showname=".1.. .... = 128-EEA1: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eea2" pos="118" show="1" showname="..1. .... = 128-EEA2: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.eea3" pos="118" show="0" showname="...0 .... = 128-EEA3: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea4" pos="118" show="0" showname=".... 0... = EEA4: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea5" pos="118" show="0" showname=".... .0.. = EEA5: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea6" pos="118" show="0" showname=".... ..0. = EEA6: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eea7" pos="118" show="0" showname=".... ...0 = EEA7: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia0" pos="119" show="1" showname="1... .... = EIA0: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eia1" pos="119" show="1" showname=".1.. .... = 128-EIA1: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.128eia2" pos="119" show="1" showname="..1. .... = 128-EIA2: Supported" size="1" unmaskedvalue="e0" value="1"/> + <field name="nas_eps.emm.eia3" pos="119" show="0" showname="...0 .... = 128-EIA3: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia4" pos="119" show="0" showname=".... 0... = EIA4: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia5" pos="119" show="0" showname=".... .0.. = EIA5: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia6" pos="119" show="0" showname=".... ..0. = EIA6: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + <field name="nas_eps.emm.eia7" pos="119" show="0" showname=".... ...0 = EIA7: Not Supported" size="1" unmaskedvalue="e0" value="0"/> + </field> + </proto> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 83: 138 bytes on wire (1104 bits), 138 bytes captured (1104 bits) on interface 0" size="138"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:53.997356000" showname="Arrival Time: Sep 25, 2015 16:34:53.997356000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191693.997356000" showname="Epoch Time: 1443191693.997356000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.018615000" showname="Time delta from previous captured frame: 0.018615000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.018615000" showname="Time delta from previous displayed frame: 0.018615000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.531725000" showname="Time since reference or first frame: 47.531725000 seconds" size="0"/> + <field name="frame.number" pos="0" show="83" showname="Frame Number: 83" size="0"/> + <field name="frame.len" pos="0" show="138" showname="Frame Length: 138 bytes (1104 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="138" showname="Capture Length: 138 bytes (1104 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="124" showname="Total Length: 124" size="2" value="007c"/> + <field name="ip.id" pos="18" show="0x0009" showname="Identification: 0x0009 (9)" size="2" value="0009"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fbc" showname="Header checksum: 0x9fbc [validation disabled]" size="2" value="9fbc"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fbc"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fbc"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xd5500667" showname="Checksum: 0xd5500667 (not verified)" size="4" value="d5500667"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 2008295178, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="0300001077b4270a0001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="2008295178" showname="Cumulative TSN ACK: 2008295178" size="4" value="77b4270a"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 3304831195, SID: 1, SSN: 3, PPID: 18, payload length: 59 bytes)" size="16" value="0003004bc4fbb8db0001000300000012"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="75" showname="Chunk length: 75" size="2" value="004b"/> + <field name="sctp.data_tsn" pos="66" show="3304831195" showname="TSN: 3304831195" size="4" value="c4fbb8db"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="3" showname="Stream sequence number: 3" size="2" value="0003"/> + <field name="sctp.data_payload_proto_id" pos="74" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + <field name="sctp.chunk_padding" pos="137" show="00" showname="Chunk padding: 00" size="1" value="00"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="59"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="59" value="000d403700000500000005c0740010d0000800048006692d001a0009084795eaf72e00075e006440080002f85900e00000004340060002f8590001"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="59" value=""> + <field name="s1ap.procedureCode" pos="79" show="13" showname="procedureCode: id-uplinkNASTransport (13)" size="1" value="0d"/> + <field hide="yes" name="per.enum_index" pos="80" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="80" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="81" show="55" showname="Open Type Length: 55" size="1" value="37"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="55" value=""> + <field name="s1ap.UplinkNASTransport" pos="82" show="" showname="UplinkNASTransport" size="55" value=""> + <field hide="yes" name="per.extension_bit" pos="82" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="83" show="5" showname="Sequence-Of Length: 5" size="2" value="0005"/> + <field name="s1ap.protocolIEs" pos="85" show="5" showname="protocolIEs: 5 items" size="52" value="00000005c0740010d0000800048006692d001a0009084795eaf72e00075e006440080002f85900e00000004340060002f8590001"> + <field name="" pos="85" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="85" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="85" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="87" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="87" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="88" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="89" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="89" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="94" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="94" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="94" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="96" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="96" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="97" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="98" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="98" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="102" show="Item 2: id-NAS-PDU" size="13" value="001a0009084795eaf72e00075e"> + <field name="s1ap.ProtocolIE_Field" pos="102" show="" showname="ProtocolIE-Field" size="13" value=""> + <field name="s1ap.id" pos="102" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="104" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="104" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="105" show="9" showname="Open Type Length: 9" size="1" value="09"/> + <field name="s1ap.value" pos="106" show="" showname="value" size="9" value=""> + <field hide="yes" name="per.octet_string_length" pos="106" show="8" showname="Octet String Length: 8" size="1" value="08"/> + <field name="s1ap.NAS_PDU" pos="107" show="47:95:ea:f7:2e:00:07:5e" showname="NAS-PDU: 4795eaf72e00075e" size="8" value="4795eaf72e00075e"/> + <proto name="nas-eps" pos="107" showname="Non-Access-Stratum (NAS)PDU" size="8"> + <field name="nas_eps.security_header_type" pos="107" show="4" showname="0100 .... = Security header type: Integrity protected and ciphered with new EPS security context (4)" size="1" unmaskedvalue="47" value="4"/> + <field name="gsm_a.L3_protocol_discriminator" pos="107" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="47" value="7"/> + <field name="nas_eps.msg_auth_code" pos="108" show="0x95eaf72e" showname="Message authentication code: 0x95eaf72e" size="4" value="95eaf72e"/> + <field name="nas_eps.seq_no" pos="112" show="0" showname="Sequence number: 0" size="1" value="00"/> + <field name="nas_eps.security_header_type" pos="113" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="113" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="114" show="0x5e" showname="NAS EPS Mobility Management Message Type: Security mode complete (0x5e)" size="1" value="5e"/> + </proto> + </field> + </field> + </field> + <field name="" pos="115" show="Item 3: id-EUTRAN-CGI" size="12" value="006440080002f85900e00000"> + <field name="s1ap.ProtocolIE_Field" pos="115" show="" showname="ProtocolIE-Field" size="12" value=""> + <field name="s1ap.id" pos="115" show="100" showname="id: id-EUTRAN-CGI (100)" size="2" value="0064"/> + <field hide="yes" name="per.enum_index" pos="117" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="117" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="118" show="8" showname="Open Type Length: 8" size="1" value="08"/> + <field name="s1ap.value" pos="119" show="" showname="value" size="8" value=""> + <field name="s1ap.EUTRAN_CGI" pos="119" show="" showname="EUTRAN-CGI" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="119" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="119" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="120" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="120" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="121" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.cell_ID" pos="119" show="00:e0:00:00" showname="cell-ID: 00e00000 [bit length 28, 4 LSB pad bits, 0000 0000 1110 0000 0000 0000 0000 .... decimal value 917504]" size="4" value="00e00000"/> + </field> + </field> + </field> + </field> + <field name="" pos="127" show="Item 4: id-TAI" size="10" value="004340060002f8590001"> + <field name="s1ap.ProtocolIE_Field" pos="127" show="" showname="ProtocolIE-Field" size="10" value=""> + <field name="s1ap.id" pos="127" show="67" showname="id: id-TAI (67)" size="2" value="0043"/> + <field hide="yes" name="per.enum_index" pos="129" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="129" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="130" show="6" showname="Open Type Length: 6" size="1" value="06"/> + <field name="s1ap.value" pos="131" show="" showname="value" size="6" value=""> + <field name="s1ap.TAI" pos="131" show="" showname="TAI" size="6" value=""> + <field hide="yes" name="per.extension_bit" pos="131" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="131" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="132" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="132" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="133" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.tAC" pos="135" show="00:01" showname="tAC: 0001" size="2" value="0001"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 84: 270 bytes on wire (2160 bits), 270 bytes captured (2160 bits) on interface 0" size="270"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:54.002963000" showname="Arrival Time: Sep 25, 2015 16:34:54.002963000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191694.002963000" showname="Epoch Time: 1443191694.002963000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.005607000" showname="Time delta from previous captured frame: 0.005607000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.005607000" showname="Time delta from previous displayed frame: 0.005607000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.537332000" showname="Time since reference or first frame: 47.537332000 seconds" size="0"/> + <field name="frame.number" pos="0" show="84" showname="Frame Number: 84" size="0"/> + <field name="frame.len" pos="0" show="270" showname="Frame Length: 270 bytes (2160 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="270" showname="Capture Length: 270 bytes (2160 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:ipcp:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:ipcp:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="256" showname="Total Length: 256" size="2" value="0100"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9f41" showname="Header checksum: 0x9f41 [validation disabled]" size="2" value="9f41"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9f41"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9f41"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xcffe2cbf" showname="Checksum: 0xcffe2cbf (not verified)" size="4" value="cffe2cbf"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831195, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8db0001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831195" showname="Cumulative TSN ACK: 3304831195" size="4" value="c4fbb8db"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 2008295179, SID: 1, SSN: 3, PPID: 301989888, payload length: 191 bytes)" size="16" value="000300cf77b4270b0001000312000000"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="207" showname="Chunk length: 207" size="2" value="00cf"/> + <field name="sctp.data_tsn" pos="66" show="2008295179" showname="TSN: 2008295179" size="4" value="77b4270b"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="3" showname="Stream sequence number: 3" size="2" value="0003"/> + <field name="sctp.data_payload_proto_id" pos="74" show="301989888" showname="Payload protocol identifier: Unknown (301989888)" size="4" value="12000000"/> + <field name="sctp.chunk_padding" pos="269" show="00" showname="Chunk padding: 00" size="1" value="00"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="191"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="191" value="00090080ba00000600000005c0740010d0000800048006692d0042000a1805f5e1006002faf080001800670000340062450009040f80c0a80c11000000015327ad0aaa9a010742014a062002f859000100315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64500bf602f8598000016c000920172c006b0005100002000000490020d3a2585db3755b592cdd43bd648158eb3d142a9f7295ef2da9003b8f7a7a5929"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="191" value=""> + <field name="s1ap.procedureCode" pos="79" show="9" showname="procedureCode: id-InitialContextSetup (9)" size="1" value="09"/> + <field hide="yes" name="per.enum_index" pos="80" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="80" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="81" show="186" showname="Open Type Length: 186" size="2" value="80ba"/> + <field name="s1ap.value" pos="83" show="" showname="value" size="186" value=""> + <field name="s1ap.InitialContextSetupRequest" pos="83" show="" showname="InitialContextSetupRequest" size="186" value=""> + <field hide="yes" name="per.extension_bit" pos="83" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="84" show="6" showname="Sequence-Of Length: 6" size="2" value="0006"/> + <field name="s1ap.protocolIEs" pos="86" show="6" showname="protocolIEs: 6 items" size="183" value="00000005c0740010d0000800048006692d0042000a1805f5e1006002faf080001800670000340062450009040f80c0a80c11000000015327ad0aaa9a010742014a062002f859000100315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64500bf602f8598000016c000920172c006b0005100002000000490020d3a2585db3755b592cdd43bd648158eb3d142a9f7295ef2da9003b8f7a7a5929"> + <field name="" pos="86" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="86" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="86" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="88" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="88" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="89" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="90" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="90" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="95" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="95" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="95" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="97" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="97" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="98" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="99" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="99" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="103" show="Item 2: id-uEaggregateMaximumBitrate" size="14" value="0042000a1805f5e1006002faf080"> + <field name="s1ap.ProtocolIE_Field" pos="103" show="" showname="ProtocolIE-Field" size="14" value=""> + <field name="s1ap.id" pos="103" show="66" showname="id: id-uEaggregateMaximumBitrate (66)" size="2" value="0042"/> + <field hide="yes" name="per.enum_index" pos="105" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="105" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="106" show="10" showname="Open Type Length: 10" size="1" value="0a"/> + <field name="s1ap.value" pos="107" show="" showname="value" size="10" value=""> + <field name="s1ap.UEAggregateMaximumBitrate" pos="107" show="" showname="UEAggregateMaximumBitrate" size="10" value=""> + <field hide="yes" name="per.extension_bit" pos="107" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="18" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="107" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="18" value="0"/> + <field name="s1ap.uEaggregateMaximumBitRateDL" pos="107" show="100000000" showname="uEaggregateMaximumBitRateDL: 100000000" size="5" value="1805f5e100"/> + <field name="s1ap.uEaggregateMaximumBitRateUL" pos="112" show="50000000" showname="uEaggregateMaximumBitRateUL: 50000000" size="5" value="6002faf080"/> + </field> + </field> + </field> + </field> + <field name="" pos="117" show="Item 3: id-E-RABToBeSetupListCtxtSUReq" size="107" value="001800670000340062450009040f80c0a80c11000000015327ad0aaa9a010742014a062002f859000100315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64500bf602f8598000016c000920172c"> + <field name="s1ap.ProtocolIE_Field" pos="117" show="" showname="ProtocolIE-Field" size="107" value=""> + <field name="s1ap.id" pos="117" show="24" showname="id: id-E-RABToBeSetupListCtxtSUReq (24)" size="2" value="0018"/> + <field hide="yes" name="per.enum_index" pos="119" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="119" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="120" show="103" showname="Open Type Length: 103" size="1" value="67"/> + <field name="s1ap.value" pos="121" show="" showname="value" size="103" value=""> + <field hide="yes" name="per.sequence_of_length" pos="121" show="1" showname="Sequence-Of Length: 1" size="1" value="00"/> + <field name="s1ap.E_RABToBeSetupListCtxtSUReq" pos="122" show="1" showname="E-RABToBeSetupListCtxtSUReq: 1 item" size="102" value="00340062450009040f80c0a80c11000000015327ad0aaa9a010742014a062002f859000100315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64500bf602f8598000016c000920172c"> + <field name="" pos="122" show="Item 0: id-E-RABToBeSetupItemCtxtSUReq" size="102" value="00340062450009040f80c0a80c11000000015327ad0aaa9a010742014a062002f859000100315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64500bf602f8598000016c000920172c"> + <field name="s1ap.ProtocolIE_SingleContainer" pos="122" show="" showname="ProtocolIE-SingleContainer" size="102" value=""> + <field name="s1ap.id" pos="122" show="52" showname="id: id-E-RABToBeSetupItemCtxtSUReq (52)" size="2" value="0034"/> + <field hide="yes" name="per.enum_index" pos="124" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="124" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="125" show="98" showname="Open Type Length: 98" size="1" value="62"/> + <field name="s1ap.value" pos="126" show="" showname="value" size="98" value=""> + <field name="s1ap.E_RABToBeSetupItemCtxtSUReq" pos="126" show="" showname="E-RABToBeSetupItemCtxtSUReq" size="98" value=""> + <field hide="yes" name="per.extension_bit" pos="126" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="45" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="126" show="1" showname=".1.. .... Optional Field Bit: True (nAS-PDU is present)" size="1" unmaskedvalue="45" value="1"/> + <field hide="yes" name="per.optional_field_bit" pos="126" show="0" showname="..0. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="45" value="0"/> + <field hide="yes" name="per.extension_present_bit" pos="126" show="0" showname="...0 .... Extension Present Bit: False" size="1" unmaskedvalue="45" value="0"/> + <field name="s1ap.e_RAB_ID" pos="126" show="5" showname="e-RAB-ID: 5" size="1" value="45"/> + <field name="s1ap.e_RABlevelQoSParameters" pos="127" show="" showname="e-RABlevelQoSParameters" size="3" value=""> + <field hide="yes" name="per.extension_bit" pos="127" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="127" show="0" showname=".0.. .... Optional Field Bit: False (gbrQosInformation is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="127" show="0" showname="..0. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.qCI" pos="128" show="9" showname="qCI: 9" size="1" value="09"/> + <field name="s1ap.allocationRetentionPriority" pos="129" show="" showname="allocationRetentionPriority" size="1" value=""> + <field hide="yes" name="per.extension_bit" pos="129" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="04" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="129" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="04" value="0"/> + <field name="s1ap.priorityLevel" pos="129" show="1" showname="priorityLevel: highest (1)" size="1" value="04"/> + <field hide="yes" name="per.enum_index" pos="129" show="0" showname="Enumerated Index: 0" size="1" value="04"/> + <field name="s1ap.pre_emptionCapability" pos="129" show="0" showname="pre-emptionCapability: shall-not-trigger-pre-emption (0)" size="1" value="04"/> + <field hide="yes" name="per.enum_index" pos="129" show="0" showname="Enumerated Index: 0" size="1" value="04"/> + <field name="s1ap.pre_emptionVulnerability" pos="129" show="0" showname="pre-emptionVulnerability: not-pre-emptable (0)" size="1" value="04"/> + </field> + </field> + <field name="per.extension_present_bit" pos="130" show="0" showname="0... .... Extension Present Bit: False" size="1" unmaskedvalue="0f" value="0"/> + <field hide="yes" name="per.bit_string_length" pos="130" show="32" showname="Bit String Length: 32" size="1" value="0f"/> + <field name="s1ap.transportLayerAddress" pos="132" show="c0:a8:0c:11" showname="transportLayerAddress: c0a80c11 [bit length 32, 1100 0000 1010 1000 0000 1100 0001 0001 decimal value 3232238609]" size="4" value="c0a80c11"> + <field name="s1ap.transportLayerAddressIPv4" pos="132" show="192.168.12.17" showname="transportLayerAddress(IPv4): 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + </field> + <field name="s1ap.gTP_TEID" pos="136" show="00:00:00:01" showname="gTP-TEID: 00000001" size="4" value="00000001"/> + <field hide="yes" name="per.octet_string_length" pos="140" show="83" showname="Octet String Length: 83" size="1" value="53"/> + <field name="s1ap.nAS_PDU" pos="141" show="27:ad:0a:aa:9a:01:07:42:01:4a:06:20:02:f8:59:00:01:00:31:52:01:c1:01:09:09:03:6f:61:69:04:69:70:76:34:05:01:c0:bc:00:02:5e:04:fe:fe:de:9e:27:14:80:80:21:10:03:00:00:10:81:06:c0:a8:6a:0c:83:06:c0:a8:0c:64:50:0b:f6:02:f8:59:80:00:01:6c:00:09:20:17:2c" showname="nAS-PDU: 27ad0aaa9a010742014a062002f859000100315201c10109..." size="83" value="27ad0aaa9a010742014a062002f859000100315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64500bf602f8598000016c000920172c"/> + <proto name="nas-eps" pos="141" showname="Non-Access-Stratum (NAS)PDU" size="83"> + <field name="nas_eps.security_header_type" pos="141" show="2" showname="0010 .... = Security header type: Integrity protected and ciphered (2)" size="1" unmaskedvalue="27" value="2"/> + <field name="gsm_a.L3_protocol_discriminator" pos="141" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="27" value="7"/> + <field name="nas_eps.msg_auth_code" pos="142" show="0xad0aaa9a" showname="Message authentication code: 0xad0aaa9a" size="4" value="ad0aaa9a"/> + <field name="nas_eps.seq_no" pos="146" show="1" showname="Sequence number: 1" size="1" value="01"/> + <field name="nas_eps.security_header_type" pos="147" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="147" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="148" show="0x42" showname="NAS EPS Mobility Management Message Type: Attach accept (0x42)" size="1" value="42"/> + <field name="nas_eps.emm.spare_half_octet" pos="149" show="0" showname="0000 .... = Spare half octet: 0" size="1" value="01"/> + <field name="nas_eps.spare_bits" pos="149" show="0x00" showname=".... 0... = Spare bit(s): 0x00" size="1" value="01"/> + <field name="nas_eps.emm.EPS_attach_result" pos="149" show="1" showname=".... .001 = Attach result: EPS only (1)" size="1" value="01"/> + <field name="" pos="150" show="GPRS Timer - T3412 value" size="1" value="4a"> + <field name="" pos="150" show="GPRS Timer: 60 min" size="1" value="4a"> + <field name="gsm_a.gm.gmm.gprs_timer_unit" pos="150" show="2" showname="010. .... = Unit: value is incremented in multiples of decihours (2)" size="1" unmaskedvalue="4a" value="2"/> + <field name="gsm_a.gm.gmm.gprs_timer_value" pos="150" show="10" showname="...0 1010 = Timer value: 10" size="1" unmaskedvalue="4a" value="A"/> + </field> + </field> + <field name="" pos="151" show="Tracking area identity list - TAI list" size="7" value="062002f8590001"> + <field name="gsm_a.len" pos="151" show="6" showname="Length: 6" size="1" value="06"/> + <field name="nas_eps.spare_bits" pos="152" show="0x00" showname="0... .... = Spare bit(s): 0x00" size="1" value="20"/> + <field name="nas_eps.emm.tai_tol" pos="152" show="1" showname=".01. .... = Type of list: list of TACs belonging to one PLMN, with consecutive TAC values (1)" size="1" unmaskedvalue="20" value="1"/> + <field name="nas_eps.emm.tai_n_elem" pos="152" show="0" showname="...0 0000 = Number of elements: 0 [+1 = 1 element(s)]" size="1" unmaskedvalue="20" value="0"/> + <field name="e212.mcc" pos="153" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="154" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="nas_eps.emm.tai_tac" pos="156" show="0x0001" showname="Tracking area code(TAC): 0x0001" size="2" value="0001"/> + </field> + <field name="" pos="158" show="ESM message container" size="51" value="00315201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64"> + <field name="gsm_a.len" pos="158" show="49" showname="Length: 49" size="2" value="0031"/> + <field name="nas_eps.emm.esm_msg_cont" pos="160" show="52:01:c1:01:09:09:03:6f:61:69:04:69:70:76:34:05:01:c0:bc:00:02:5e:04:fe:fe:de:9e:27:14:80:80:21:10:03:00:00:10:81:06:c0:a8:6a:0c:83:06:c0:a8:0c:64" showname="ESM message container contents: 5201c1010909036f616904697076340501c0bc00025e04fe..." size="49" value="5201c1010909036f616904697076340501c0bc00025e04fefede9e271480802110030000108106c0a86a0c8306c0a80c64"> + <field name="nas_eps.bearer_id" pos="160" show="5" showname="0101 .... = EPS bearer identity: EPS bearer identity value 5 (5)" size="1" unmaskedvalue="52" value="5"/> + <field name="gsm_a.L3_protocol_discriminator" pos="160" show="0x02" showname=".... 0010 = Protocol discriminator: EPS session management messages (0x02)" size="1" unmaskedvalue="52" value="2"/> + <field name="nas_eps.esm.proc_trans_id" pos="161" show="1" showname="Procedure transaction identity: 1" size="1" value="01"/> + <field name="nas_eps.nas_msg_esm_type" pos="162" show="0xc1" showname="NAS EPS session management messages: Activate default EPS bearer context request (0xc1)" size="1" value="c1"/> + <field name="" pos="163" show="EPS quality of service" size="2" value="0109"> + <field name="gsm_a.len" pos="163" show="1" showname="Length: 1" size="1" value="01"/> + <field name="nas_eps.emm.qci" pos="164" show="9" showname="Quality of Service Class Identifier (QCI): QCI 9 (9)" size="1" value="09"/> + </field> + <field name="" pos="165" show="Access Point Name" size="10" value="09036f61690469707634"> + <field name="gsm_a.len" pos="165" show="9" showname="Length: 9" size="1" value="09"/> + <field name="gsm_a.gm.sm.apn" pos="166" show="oai.ipv4" showname="APN: oai.ipv4" size="9" value="036f61690469707634"/> + </field> + <field name="" pos="175" show="PDN address" size="6" value="0501c0bc0002"> + <field name="gsm_a.len" pos="175" show="5" showname="Length: 5" size="1" value="05"/> + <field name="nas_eps.spare_bits" pos="176" show="0x00" showname="0000 0... = Spare bit(s): 0x00" size="1" value="01"/> + <field name="nas_eps.esm_pdn_type" pos="176" show="1" showname="PDN type: IPv4 (1)" size="1" value="01"/> + <field name="nas_eps.esm.pdn_ipv4" pos="177" show="192.188.0.2" showname="PDN IPv4: 192.188.0.2 (192.188.0.2)" size="4" value="c0bc0002"/> + </field> + <field name="" pos="181" show="APN aggregate maximum bit rate" size="6" value="5e04fefede9e"> + <field name="nas_eps.esm.elem_id" pos="181" show="0x5e" showname="Element ID: 0x5e" size="1" value="5e"/> + <field name="gsm_a.len" pos="182" show="4" showname="Length: 4" size="1" value="04"/> + <field name="nas_eps.emm.apn_ambr_dl" pos="183" show="254" showname="APN-AMBR for downlink : 8640 kbps" size="1" value="fe"/> + <field name="nas_eps.emm.apn_ambr_ul" pos="184" show="254" showname="APN-AMBR for uplink : 8640 kbps" size="1" value="fe"/> + <field name="nas_eps.emm.apn_ambr_dl_ext" pos="185" show="222" showname="APN-AMBR for downlink (extended) : 200 Mbps" size="1" value="de"/> + <field name="" pos="185" show="Total APN-AMBR for downlink : 200,000 Mbps" size="1" value="de"/> + <field name="nas_eps.emm.apn_ambr_ul_ext" pos="186" show="158" showname="APN-AMBR for uplink (extended) : 100 Mbps" size="1" value="9e"/> + <field name="" pos="186" show="Total APN-AMBR for uplink : 100,000 Mbps" size="1" value="9e"/> + </field> + <field name="" pos="187" show="Protocol Configuration Options" size="22" value="271480802110030000108106c0a86a0c8306c0a80c64"> + <field name="gsm_a.gm.elem_id" pos="187" show="0x27" showname="Element ID: 0x27" size="1" value="27"/> + <field name="gsm_a.len" pos="188" show="20" showname="Length: 20" size="1" value="14"/> + <field name="gsm_a.gm.sm.link_dir" pos="189" show="1" showname="Link direction: Network to MS (1)" size="0"/> + <field name="gsm_a.gm.sm.ext" pos="189" show="1" showname="1... .... = Extension: True" size="1" unmaskedvalue="80" value="1"/> + <field name="" pos="189" show="Configuration Protocol: PPP for use with IP PDP type or IP PDN type (0)" size="1" value="80"/> + <field name="gsm_a.gm.sm.pco_pid" pos="190" show="32801" showname="Protocol or Container ID: Internet Protocol Control Protocol (0x8021)" size="2" value="8021"> + <field name="" pos="192" show="Length: 0x10 (16)" size="1" value="10"/> + <proto name="ipcp" pos="193" showname="PPP IP Control Protocol" size="16"> + <field name="ppp.code" pos="193" show="3" showname="Code: Configuration Nak (3)" size="1" value="03"/> + <field name="ppp.identifier" pos="194" show="0" showname="Identifier: 0 (0x00)" size="1" value="00"/> + <field name="ppp.length" pos="195" show="16" showname="Length: 16" size="2" value="0010"/> + <field name="" pos="197" show="Options: (12 bytes), Primary DNS Server IP Address, Secondary DNS Server IP Address" size="12" value="8106c0a86a0c8306c0a80c64"> + <field name="" pos="197" show="Primary DNS Server IP Address: 192.168.106.12" size="6" value="8106c0a86a0c"> + <field name="ipcp.opt.type" pos="197" show="129" showname="Type: Primary DNS Server IP Address (129)" size="1" value="81"/> + <field name="ipcp.opt.length" pos="198" show="6" showname="Length: 6" size="1" value="06"/> + <field name="ipcp.opt.pri_dns_address" pos="199" show="192.168.106.12" showname="Primary DNS Address: 192.168.106.12 (192.168.106.12)" size="4" value="c0a86a0c"/> + </field> + <field name="" pos="203" show="Secondary DNS Server IP Address: 192.168.12.100" size="6" value="8306c0a80c64"> + <field name="ipcp.opt.type" pos="203" show="131" showname="Type: Secondary DNS Server IP Address (131)" size="1" value="83"/> + <field name="ipcp.opt.length" pos="204" show="6" showname="Length: 6" size="1" value="06"/> + <field name="ipcp.opt.sec_dns_address" pos="205" show="192.168.12.100" showname="Secondary DNS Address: 192.168.12.100 (192.168.12.100)" size="4" value="c0a80c64"/> + </field> + </field> + </proto> + </field> + </field> + </field> + </field> + <field name="" pos="209" show="EPS mobile identity - GUTI" size="13" value="500bf602f8598000016c000920"> + <field name="nas_eps.emm.elem_id" pos="209" show="0x50" showname="Element ID: 0x50" size="1" value="50"/> + <field name="gsm_a.len" pos="210" show="11" showname="Length: 11" size="1" value="0b"/> + <field name="nas_eps.emm.odd_even" pos="211" show="0" showname=".... 0... = odd/even indic: 0" size="1" unmaskedvalue="f6" value="0"/> + <field name="nas_eps.emm.type_of_id" pos="211" show="6" showname=".... .110 = Type of identity: GUTI (6)" size="1" unmaskedvalue="f6" value="6"/> + <field name="e212.mcc" pos="212" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="213" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="nas_eps.emm.mme_grp_id" pos="215" show="32768" showname="MME Group ID: 32768" size="2" value="8000"/> + <field name="nas_eps.emm.mme_code" pos="217" show="1" showname="MME Code: 1" size="1" value="01"/> + <field name="nas_eps.emm.m_tmsi" pos="218" show="0x6c000920" showname="M-TMSI: 0x6c000920" size="4" value="6c000920"/> + </field> + <field name="" pos="222" show="GPRS Timer - T3402 value" size="2" value="172c"> + <field name="gsm_a.gm.elem_id" pos="222" show="0x17" showname="Element ID: 0x17" size="1" value="17"/> + <field name="" pos="223" show="GPRS Timer: 12 min" size="1" value="2c"> + <field name="gsm_a.gm.gmm.gprs_timer_unit" pos="223" show="1" showname="001. .... = Unit: value is incremented in multiples of 1 minute (1)" size="1" unmaskedvalue="2c" value="1"/> + <field name="gsm_a.gm.gmm.gprs_timer_value" pos="223" show="12" showname="...0 1100 = Timer value: 12" size="1" unmaskedvalue="2c" value="C"/> + </field> + </field> + </proto> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + <field name="" pos="224" show="Item 4: id-UESecurityCapabilities" size="9" value="006b00051000020000"> + <field name="s1ap.ProtocolIE_Field" pos="224" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="224" show="107" showname="id: id-UESecurityCapabilities (107)" size="2" value="006b"/> + <field hide="yes" name="per.enum_index" pos="226" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="226" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="227" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="228" show="" showname="value" size="5" value=""> + <field name="s1ap.UESecurityCapabilities" pos="228" show="" showname="UESecurityCapabilities" size="4" value=""> + <field hide="yes" name="per.extension_bit" pos="228" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="10" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="228" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="10" value="0"/> + <field name="per.extension_present_bit" pos="228" show="0" showname="..0. .... Extension Present Bit: False" size="1" unmaskedvalue="10" value="0"/> + <field name="s1ap.encryptionAlgorithms" pos="228" show="80:00" showname="encryptionAlgorithms: 8000 [bit length 16, 1000 0000 0000 0000 decimal value 32768]" size="2" value="8000"/> + <field name="per.extension_present_bit" pos="230" show="0" showname="...0 .... Extension Present Bit: False" size="1" unmaskedvalue="02" value="0"/> + <field name="s1ap.integrityProtectionAlgorithms" pos="228" show="20:00" showname="integrityProtectionAlgorithms: 2000 [bit length 16, 0010 0000 0000 0000 decimal value 8192]" size="2" value="2000"/> + </field> + </field> + </field> + </field> + <field name="" pos="233" show="Item 5: id-SecurityKey" size="36" value="00490020d3a2585db3755b592cdd43bd648158eb3d142a9f7295ef2da9003b8f7a7a5929"> + <field name="s1ap.ProtocolIE_Field" pos="233" show="" showname="ProtocolIE-Field" size="36" value=""> + <field name="s1ap.id" pos="233" show="73" showname="id: id-SecurityKey (73)" size="2" value="0049"/> + <field hide="yes" name="per.enum_index" pos="235" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="235" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="236" show="32" showname="Open Type Length: 32" size="1" value="20"/> + <field name="s1ap.value" pos="237" show="" showname="value" size="32" value=""> + <field name="s1ap.SecurityKey" pos="237" show="d3:a2:58:5d:b3:75:5b:59:2c:dd:43:bd:64:81:58:eb:3d:14:2a:9f:72:95:ef:2d:a9:00:3b:8f:7a:7a:59:29" showname="SecurityKey: d3a2585db3755b592cdd43bd648158eb3d142a9f7295ef2d... [bit length 256]" size="32" value="d3a2585db3755b592cdd43bd648158eb3d142a9f7295ef2da9003b8f7a7a5929"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 86: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits) on interface 0" size="126"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:54.029328000" showname="Arrival Time: Sep 25, 2015 16:34:54.029328000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191694.029328000" showname="Epoch Time: 1443191694.029328000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.006335000" showname="Time delta from previous captured frame: 0.006335000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.006335000" showname="Time delta from previous displayed frame: 0.006335000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.563697000" showname="Time since reference or first frame: 47.563697000 seconds" size="0"/> + <field name="frame.number" pos="0" show="86" showname="Frame Number: 86" size="0"/> + <field name="frame.len" pos="0" show="126" showname="Frame Length: 126 bytes (1008 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="126" showname="Capture Length: 126 bytes (1008 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="112" showname="Total Length: 112" size="2" value="0070"/> + <field name="ip.id" pos="18" show="0x000a" showname="Identification: 0x000a (10)" size="2" value="000a"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fc7" showname="Header checksum: 0x9fc7 [validation disabled]" size="2" value="9fc7"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fc7"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fc7"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="44"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x936ee321" showname="Checksum: 0x936ee321 (not verified)" size="4" value="936ee321"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 2008295179, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="0300001077b4270b0001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="2008295179" showname="Cumulative TSN ACK: 2008295179" size="4" value="77b4270b"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + <field name="" pos="62" show="DATA chunk(ordered, complete segment, TSN: 3304831196, SID: 1, SSN: 4, PPID: 18, payload length: 48 bytes)" size="16" value="00030040c4fbb8dc0001000400000012"> + <field name="sctp.chunk_type" pos="62" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="62" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="62" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="63" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="63" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="63" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="63" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="63" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="64" show="64" showname="Chunk length: 64" size="2" value="0040"/> + <field name="sctp.data_tsn" pos="66" show="3304831196" showname="TSN: 3304831196" size="4" value="c4fbb8dc"/> + <field name="sctp.data_sid" pos="70" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="72" show="4" showname="Stream sequence number: 4" size="2" value="0004"/> + <field name="sctp.data_payload_proto_id" pos="74" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + </field> + <proto name="s1ap" pos="78" showname="S1 Application Protocol" size="48"> + <field hide="yes" name="per.extension_bit" pos="78" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="78" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="78" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="48" value="0016402c00000300000005c0740010d0000800048006692d004a40141381200003001060e0c1f83f07e0fd7837620000"> + <field name="s1ap.initiatingMessage" pos="78" show="" showname="initiatingMessage" size="48" value=""> + <field name="s1ap.procedureCode" pos="79" show="22" showname="procedureCode: id-UECapabilityInfoIndication (22)" size="1" value="16"/> + <field hide="yes" name="per.enum_index" pos="80" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="80" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="81" show="44" showname="Open Type Length: 44" size="1" value="2c"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="44" value=""> + <field name="s1ap.UECapabilityInfoIndication" pos="82" show="" showname="UECapabilityInfoIndication" size="44" value=""> + <field hide="yes" name="per.extension_bit" pos="82" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="83" show="3" showname="Sequence-Of Length: 3" size="2" value="0003"/> + <field name="s1ap.protocolIEs" pos="85" show="3" showname="protocolIEs: 3 items" size="41" value="00000005c0740010d0000800048006692d004a40141381200003001060e0c1f83f07e0fd7837620000"> + <field name="" pos="85" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="85" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="85" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="87" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="87" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="88" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="89" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="89" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="94" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="94" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="94" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="96" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="96" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="97" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="98" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="98" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="102" show="Item 2: id-UERadioCapability" size="24" value="004a40141381200003001060e0c1f83f07e0fd7837620000"> + <field name="s1ap.ProtocolIE_Field" pos="102" show="" showname="ProtocolIE-Field" size="24" value=""> + <field name="s1ap.id" pos="102" show="74" showname="id: id-UERadioCapability (74)" size="2" value="004a"/> + <field hide="yes" name="per.enum_index" pos="104" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="104" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="105" show="20" showname="Open Type Length: 20" size="1" value="14"/> + <field name="s1ap.value" pos="106" show="" showname="value" size="20" value=""> + <field hide="yes" name="per.octet_string_length" pos="106" show="19" showname="Octet String Length: 19" size="1" value="13"/> + <field name="s1ap.UERadioCapability" pos="107" show="81:20:00:03:00:10:60:e0:c1:f8:3f:07:e0:fd:78:37:62:00:00" showname="UERadioCapability: 81200003001060e0c1f83f07e0fd7837620000" size="19" value="81200003001060e0c1f83f07e0fd7837620000"> + <field name="lte-rrc.UERadioAccessCapabilityInformation" pos="107" show="" showname="UERadioAccessCapabilityInformation" size="1" value=""> + <field hide="yes" name="per.choice_index" pos="107" show="1" showname="Choice Index: 1" size="1" value="81"/> + <field name="lte-rrc.criticalExtensions" pos="107" show="1" showname="criticalExtensions: criticalExtensionsFuture (1)" size="1" value="81"> + <field name="lte-rrc.criticalExtensionsFuture" pos="107" show="" showname="criticalExtensionsFuture" size="1" value=""/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 87: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0" size="62"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:54.226130000" showname="Arrival Time: Sep 25, 2015 16:34:54.226130000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191694.226130000" showname="Epoch Time: 1443191694.226130000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.196802000" showname="Time delta from previous captured frame: 0.196802000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.196802000" showname="Time delta from previous displayed frame: 0.196802000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.760499000" showname="Time since reference or first frame: 47.760499000 seconds" size="0"/> + <field name="frame.number" pos="0" show="87" showname="Frame Number: 87" size="0"/> + <field name="frame.len" pos="0" show="62" showname="Frame Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="62" showname="Capture Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="48" showname="Total Length: 48" size="2" value="0030"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa011" showname="Header checksum: 0xa011 [validation disabled]" size="2" value="a011"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a011"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a011"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x4bc96ec5" showname="Checksum: 0x4bc96ec5 (not verified)" size="4" value="4bc96ec5"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831196, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8dc0001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831196" showname="Cumulative TSN ACK: 3304831196" size="4" value="c4fbb8dc"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 88: 186 bytes on wire (1488 bits), 186 bytes captured (1488 bits) on interface 0" size="186"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:54.226402000" showname="Arrival Time: Sep 25, 2015 16:34:54.226402000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191694.226402000" showname="Epoch Time: 1443191694.226402000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000272000" showname="Time delta from previous captured frame: 0.000272000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000272000" showname="Time delta from previous displayed frame: 0.000272000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.760771000" showname="Time since reference or first frame: 47.760771000 seconds" size="0"/> + <field name="frame.number" pos="0" show="88" showname="Frame Number: 88" size="0"/> + <field name="frame.len" pos="0" show="186" showname="Frame Length: 186 bytes (1488 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="186" showname="Capture Length: 186 bytes (1488 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" showname="Protocols in frame: eth:ip:sctp:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:s1ap:nas-eps:s1ap:s1ap" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="172" showname="Total Length: 172" size="2" value="00ac"/> + <field name="ip.id" pos="18" show="0x000b" showname="Identification: 0x000b (11)" size="2" value="000b"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9f8a" showname="Header checksum: 0x9f8a [validation disabled]" size="2" value="9f8a"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9f8a"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9f8a"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xb000a908" showname="Checksum: 0xb000a908 (not verified)" size="4" value="b000a908"/> + <field name="" pos="46" show="DATA chunk(ordered, complete segment, TSN: 3304831197, SID: 1, SSN: 5, PPID: 18, payload length: 43 bytes)" size="16" value="0003003bc4fbb8dd0001000500000012"> + <field name="sctp.chunk_type" pos="46" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="47" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="47" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="47" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="47" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="59" showname="Chunk length: 59" size="2" value="003b"/> + <field name="sctp.data_tsn" pos="50" show="3304831197" showname="TSN: 3304831197" size="4" value="c4fbb8dd"/> + <field name="sctp.data_sid" pos="54" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="56" show="5" showname="Stream sequence number: 5" size="2" value="0005"/> + <field name="sctp.data_payload_proto_id" pos="58" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + <field name="sctp.chunk_padding" pos="105" show="00" showname="Chunk padding: 00" size="1" value="00"/> + </field> + <proto name="s1ap" pos="62" showname="S1 Application Protocol" size="43"> + <field hide="yes" name="per.extension_bit" pos="62" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="20" value="0"/> + <field hide="yes" name="per.choice_index" pos="62" show="1" showname="Choice Index: 1" size="1" value="20"/> + <field name="s1ap.S1AP_PDU" pos="62" show="1" showname="S1AP-PDU: successfulOutcome (1)" size="43" value="2009002700000300004005c0740010d0000840048006692d0033400f000032400a0a1fc0a80cd5ca6fe0dd"> + <field name="s1ap.successfulOutcome" pos="62" show="" showname="successfulOutcome" size="43" value=""> + <field name="s1ap.procedureCode" pos="63" show="9" showname="procedureCode: id-InitialContextSetup (9)" size="1" value="09"/> + <field hide="yes" name="per.enum_index" pos="64" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="64" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="65" show="39" showname="Open Type Length: 39" size="1" value="27"/> + <field name="s1ap.value" pos="66" show="" showname="value" size="39" value=""> + <field name="s1ap.InitialContextSetupResponse" pos="66" show="" showname="InitialContextSetupResponse" size="39" value=""> + <field hide="yes" name="per.extension_bit" pos="66" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="67" show="3" showname="Sequence-Of Length: 3" size="2" value="0003"/> + <field name="s1ap.protocolIEs" pos="69" show="3" showname="protocolIEs: 3 items" size="36" value="00004005c0740010d0000840048006692d0033400f000032400a0a1fc0a80cd5ca6fe0dd"> + <field name="" pos="69" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00004005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="69" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="69" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="71" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="71" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="72" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="73" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="73" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="78" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000840048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="78" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="78" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="80" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="80" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="81" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="82" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="82" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="86" show="Item 2: id-E-RABSetupListCtxtSURes" size="19" value="0033400f000032400a0a1fc0a80cd5ca6fe0dd"> + <field name="s1ap.ProtocolIE_Field" pos="86" show="" showname="ProtocolIE-Field" size="19" value=""> + <field name="s1ap.id" pos="86" show="51" showname="id: id-E-RABSetupListCtxtSURes (51)" size="2" value="0033"/> + <field hide="yes" name="per.enum_index" pos="88" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="88" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="89" show="15" showname="Open Type Length: 15" size="1" value="0f"/> + <field name="s1ap.value" pos="90" show="" showname="value" size="15" value=""> + <field hide="yes" name="per.sequence_of_length" pos="90" show="1" showname="Sequence-Of Length: 1" size="1" value="00"/> + <field name="s1ap.E_RABSetupListCtxtSURes" pos="91" show="1" showname="E-RABSetupListCtxtSURes: 1 item" size="14" value="0032400a0a1fc0a80cd5ca6fe0dd"> + <field name="" pos="91" show="Item 0: id-E-RABSetupItemCtxtSURes" size="14" value="0032400a0a1fc0a80cd5ca6fe0dd"> + <field name="s1ap.ProtocolIE_SingleContainer" pos="91" show="" showname="ProtocolIE-SingleContainer" size="14" value=""> + <field name="s1ap.id" pos="91" show="50" showname="id: id-E-RABSetupItemCtxtSURes (50)" size="2" value="0032"/> + <field hide="yes" name="per.enum_index" pos="93" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="93" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="94" show="10" showname="Open Type Length: 10" size="1" value="0a"/> + <field name="s1ap.value" pos="95" show="" showname="value" size="10" value=""> + <field name="s1ap.E_RABSetupItemCtxtSURes" pos="95" show="" showname="E-RABSetupItemCtxtSURes" size="10" value=""> + <field hide="yes" name="per.extension_bit" pos="95" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="0a" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="95" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="0a" value="0"/> + <field hide="yes" name="per.extension_present_bit" pos="95" show="0" showname="..0. .... Extension Present Bit: False" size="1" unmaskedvalue="0a" value="0"/> + <field name="s1ap.e_RAB_ID" pos="95" show="5" showname="e-RAB-ID: 5" size="1" value="0a"/> + <field name="per.extension_present_bit" pos="95" show="0" showname=".... ...0 Extension Present Bit: False" size="1" unmaskedvalue="0a" value="0"/> + <field hide="yes" name="per.bit_string_length" pos="96" show="32" showname="Bit String Length: 32" size="1" value="1f"/> + <field name="s1ap.transportLayerAddress" pos="97" show="c0:a8:0c:d5" showname="transportLayerAddress: c0a80cd5 [bit length 32, 1100 0000 1010 1000 0000 1100 1101 0101 decimal value 3232238805]" size="4" value="c0a80cd5"> + <field name="s1ap.transportLayerAddressIPv4" pos="97" show="192.168.12.213" showname="transportLayerAddress(IPv4): 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + </field> + <field name="s1ap.gTP_TEID" pos="101" show="ca:6f:e0:dd" showname="gTP-TEID: ca6fe0dd" size="4" value="ca6fe0dd"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + <proto name="sctp" pos="106" showname="Stream Control Transmission Protocol" size="16"> + <field name="" pos="106" show="DATA chunk(ordered, complete segment, TSN: 3304831198, SID: 1, SSN: 6, PPID: 18, payload length: 64 bytes)" size="16" value="00030050c4fbb8de0001000600000012"> + <field name="sctp.chunk_type" pos="106" show="0" showname="Chunk type: DATA (0)" size="1" value="00"> + <field name="sctp.chunk_bit_1" pos="106" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="00" value="0"/> + <field name="sctp.chunk_bit_2" pos="106" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="107" show="0x03" showname="Chunk flags: 0x03" size="1" value="03"> + <field name="sctp.data_e_bit" pos="107" show="1" showname=".... ...1 = E-Bit: Last segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_b_bit" pos="107" show="1" showname=".... ..1. = B-Bit: First segment" size="1" unmaskedvalue="03" value="1"/> + <field name="sctp.data_u_bit" pos="107" show="0" showname=".... .0.. = U-Bit: Ordered delivery" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.data_i_bit" pos="107" show="0" showname=".... 0... = I-Bit: Possibly delay SACK" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_length" pos="108" show="80" showname="Chunk length: 80" size="2" value="0050"/> + <field name="sctp.data_tsn" pos="110" show="3304831198" showname="TSN: 3304831198" size="4" value="c4fbb8de"/> + <field name="sctp.data_sid" pos="114" show="0x0001" showname="Stream Identifier: 0x0001" size="2" value="0001"/> + <field name="sctp.data_ssn" pos="116" show="6" showname="Stream sequence number: 6" size="2" value="0006"/> + <field name="sctp.data_payload_proto_id" pos="118" show="18" showname="Payload protocol identifier: S1 Application Protocol (S1AP) (18)" size="4" value="00000012"/> + </field> + <proto name="s1ap" pos="122" showname="S1 Application Protocol" size="64"> + <field hide="yes" name="per.extension_bit" pos="122" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.choice_index" pos="122" show="0" showname="Choice Index: 0" size="1" value="00"/> + <field name="s1ap.S1AP_PDU" pos="122" show="0" showname="S1AP-PDU: initiatingMessage (0)" size="64" value="000d403c00000500000005c0740010d0000800048006692d001a000e0d275cf0408901074300035200c2006440080002f85900e00000004340060002f8590001"> + <field name="s1ap.initiatingMessage" pos="122" show="" showname="initiatingMessage" size="64" value=""> + <field name="s1ap.procedureCode" pos="123" show="13" showname="procedureCode: id-uplinkNASTransport (13)" size="1" value="0d"/> + <field hide="yes" name="per.enum_index" pos="124" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="124" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="125" show="60" showname="Open Type Length: 60" size="1" value="3c"/> + <field name="s1ap.value" pos="126" show="" showname="value" size="60" value=""> + <field name="s1ap.UplinkNASTransport" pos="126" show="" showname="UplinkNASTransport" size="60" value=""> + <field hide="yes" name="per.extension_bit" pos="126" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.sequence_of_length" pos="127" show="5" showname="Sequence-Of Length: 5" size="2" value="0005"/> + <field name="s1ap.protocolIEs" pos="129" show="5" showname="protocolIEs: 5 items" size="57" value="00000005c0740010d0000800048006692d001a000e0d275cf0408901074300035200c2006440080002f85900e00000004340060002f8590001"> + <field name="" pos="129" show="Item 0: id-MME-UE-S1AP-ID" size="9" value="00000005c0740010d0"> + <field name="s1ap.ProtocolIE_Field" pos="129" show="" showname="ProtocolIE-Field" size="9" value=""> + <field name="s1ap.id" pos="129" show="0" showname="id: id-MME-UE-S1AP-ID (0)" size="2" value="0000"/> + <field hide="yes" name="per.enum_index" pos="131" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="131" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="132" show="5" showname="Open Type Length: 5" size="1" value="05"/> + <field name="s1ap.value" pos="133" show="" showname="value" size="5" value=""> + <field name="s1ap.MME_UE_S1AP_ID" pos="133" show="1946161360" showname="MME-UE-S1AP-ID: 1946161360" size="5" value="c0740010d0"/> + </field> + </field> + </field> + <field name="" pos="138" show="Item 1: id-eNB-UE-S1AP-ID" size="8" value="000800048006692d"> + <field name="s1ap.ProtocolIE_Field" pos="138" show="" showname="ProtocolIE-Field" size="8" value=""> + <field name="s1ap.id" pos="138" show="8" showname="id: id-eNB-UE-S1AP-ID (8)" size="2" value="0008"/> + <field hide="yes" name="per.enum_index" pos="140" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="140" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="141" show="4" showname="Open Type Length: 4" size="1" value="04"/> + <field name="s1ap.value" pos="142" show="" showname="value" size="4" value=""> + <field name="s1ap.ENB_UE_S1AP_ID" pos="142" show="420141" showname="ENB-UE-S1AP-ID: 420141" size="4" value="8006692d"/> + </field> + </field> + </field> + <field name="" pos="146" show="Item 2: id-NAS-PDU" size="18" value="001a000e0d275cf0408901074300035200c2"> + <field name="s1ap.ProtocolIE_Field" pos="146" show="" showname="ProtocolIE-Field" size="18" value=""> + <field name="s1ap.id" pos="146" show="26" showname="id: id-NAS-PDU (26)" size="2" value="001a"/> + <field hide="yes" name="per.enum_index" pos="148" show="0" showname="Enumerated Index: 0" size="1" value="00"/> + <field name="s1ap.criticality" pos="148" show="0" showname="criticality: reject (0)" size="1" value="00"/> + <field hide="yes" name="per.open_type_length" pos="149" show="14" showname="Open Type Length: 14" size="1" value="0e"/> + <field name="s1ap.value" pos="150" show="" showname="value" size="14" value=""> + <field hide="yes" name="per.octet_string_length" pos="150" show="13" showname="Octet String Length: 13" size="1" value="0d"/> + <field name="s1ap.NAS_PDU" pos="151" show="27:5c:f0:40:89:01:07:43:00:03:52:00:c2" showname="NAS-PDU: 275cf0408901074300035200c2" size="13" value="275cf0408901074300035200c2"/> + <proto name="nas-eps" pos="151" showname="Non-Access-Stratum (NAS)PDU" size="13"> + <field name="nas_eps.security_header_type" pos="151" show="2" showname="0010 .... = Security header type: Integrity protected and ciphered (2)" size="1" unmaskedvalue="27" value="2"/> + <field name="gsm_a.L3_protocol_discriminator" pos="151" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="27" value="7"/> + <field name="nas_eps.msg_auth_code" pos="152" show="0x5cf04089" showname="Message authentication code: 0x5cf04089" size="4" value="5cf04089"/> + <field name="nas_eps.seq_no" pos="156" show="1" showname="Sequence number: 1" size="1" value="01"/> + <field name="nas_eps.security_header_type" pos="157" show="0" showname="0000 .... = Security header type: Plain NAS message, not security protected (0)" size="1" unmaskedvalue="07" value="0"/> + <field name="gsm_a.L3_protocol_discriminator" pos="157" show="0x07" showname=".... 0111 = Protocol discriminator: EPS mobility management messages (0x07)" size="1" unmaskedvalue="07" value="7"/> + <field name="nas_eps.nas_msg_emm_type" pos="158" show="0x43" showname="NAS EPS Mobility Management Message Type: Attach complete (0x43)" size="1" value="43"/> + <field name="" pos="159" show="ESM message container" size="5" value="00035200c2"> + <field name="gsm_a.len" pos="159" show="3" showname="Length: 3" size="2" value="0003"/> + <field name="nas_eps.emm.esm_msg_cont" pos="161" show="52:00:c2" showname="ESM message container contents: 5200c2" size="3" value="5200c2"> + <field name="nas_eps.bearer_id" pos="161" show="5" showname="0101 .... = EPS bearer identity: EPS bearer identity value 5 (5)" size="1" unmaskedvalue="52" value="5"/> + <field name="gsm_a.L3_protocol_discriminator" pos="161" show="0x02" showname=".... 0010 = Protocol discriminator: EPS session management messages (0x02)" size="1" unmaskedvalue="52" value="2"/> + <field name="nas_eps.esm.proc_trans_id" pos="162" show="0" showname="Procedure transaction identity: 0" size="1" value="00"/> + <field name="nas_eps.nas_msg_esm_type" pos="163" show="0xc2" showname="NAS EPS session management messages: Activate default EPS bearer context accept (0xc2)" size="1" value="c2"/> + </field> + </field> + </proto> + </field> + </field> + </field> + <field name="" pos="164" show="Item 3: id-EUTRAN-CGI" size="12" value="006440080002f85900e00000"> + <field name="s1ap.ProtocolIE_Field" pos="164" show="" showname="ProtocolIE-Field" size="12" value=""> + <field name="s1ap.id" pos="164" show="100" showname="id: id-EUTRAN-CGI (100)" size="2" value="0064"/> + <field hide="yes" name="per.enum_index" pos="166" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="166" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="167" show="8" showname="Open Type Length: 8" size="1" value="08"/> + <field name="s1ap.value" pos="168" show="" showname="value" size="8" value=""> + <field name="s1ap.EUTRAN_CGI" pos="168" show="" showname="EUTRAN-CGI" size="7" value=""> + <field hide="yes" name="per.extension_bit" pos="168" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="168" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="169" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="169" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="170" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.cell_ID" pos="168" show="00:e0:00:00" showname="cell-ID: 00e00000 [bit length 28, 4 LSB pad bits, 0000 0000 1110 0000 0000 0000 0000 .... decimal value 917504]" size="4" value="00e00000"/> + </field> + </field> + </field> + </field> + <field name="" pos="176" show="Item 4: id-TAI" size="10" value="004340060002f8590001"> + <field name="s1ap.ProtocolIE_Field" pos="176" show="" showname="ProtocolIE-Field" size="10" value=""> + <field name="s1ap.id" pos="176" show="67" showname="id: id-TAI (67)" size="2" value="0043"/> + <field hide="yes" name="per.enum_index" pos="178" show="1" showname="Enumerated Index: 1" size="1" value="40"/> + <field name="s1ap.criticality" pos="178" show="1" showname="criticality: ignore (1)" size="1" value="40"/> + <field hide="yes" name="per.open_type_length" pos="179" show="6" showname="Open Type Length: 6" size="1" value="06"/> + <field name="s1ap.value" pos="180" show="" showname="value" size="6" value=""> + <field name="s1ap.TAI" pos="180" show="" showname="TAI" size="6" value=""> + <field hide="yes" name="per.extension_bit" pos="180" show="0" showname="0... .... Extension Bit: False" size="1" unmaskedvalue="00" value="0"/> + <field hide="yes" name="per.optional_field_bit" pos="180" show="0" showname=".0.. .... Optional Field Bit: False (iE-Extensions is NOT present)" size="1" unmaskedvalue="00" value="0"/> + <field name="s1ap.pLMNidentity" pos="181" show="02:f8:59" showname="pLMNidentity: 02f859" size="3" value="02f859"/> + <field name="e212.mcc" pos="181" show="208" showname="Mobile Country Code (MCC): France (208)" size="2" value="02f8"/> + <field name="e212.mnc" pos="182" show="95" showname="Mobile Network Code (MNC): Unknown (95)" size="2" value="f859"/> + <field name="s1ap.tAC" pos="184" show="00:01" showname="tAC: 0001" size="2" value="0001"/> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </field> + </proto> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 89: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0" size="62"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:34:54.426135000" showname="Arrival Time: Sep 25, 2015 16:34:54.426135000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191694.426135000" showname="Epoch Time: 1443191694.426135000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.199733000" showname="Time delta from previous captured frame: 0.199733000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.199733000" showname="Time delta from previous displayed frame: 0.199733000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="47.960504000" showname="Time since reference or first frame: 47.960504000 seconds" size="0"/> + <field name="frame.number" pos="0" show="89" showname="Frame Number: 89" size="0"/> + <field name="frame.len" pos="0" show="62" showname="Frame Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="62" showname="Capture Length: 62 bytes (496 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="48" showname="Total Length: 48" size="2" value="0030"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa011" showname="Header checksum: 0xa011 [validation disabled]" size="2" value="a011"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a011"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a011"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="28"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x2a13ff28" showname="Checksum: 0x2a13ff28 (not verified)" size="4" value="2a13ff28"/> + <field name="" pos="46" show="SACK chunk (Cumulative TSN: 3304831198, a_rwnd: 106496, gaps: 0, duplicate TSNs: 0)" size="16" value="03000010c4fbb8de0001a00000000000"> + <field name="sctp.chunk_type" pos="46" show="3" showname="Chunk type: SACK (3)" size="1" value="03"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="03" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="03" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.sack_nounce_sum" pos="47" show="0" showname=".... ...0 = Nounce sum: 0" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="16" showname="Chunk length: 16" size="2" value="0010"/> + <field name="sctp.sack_cumulative_tsn_ack" pos="50" show="3304831198" showname="Cumulative TSN ACK: 3304831198" size="4" value="c4fbb8de"/> + <field name="sctp.sack_a_rwnd" pos="54" show="106496" showname="Advertised receiver window credit (a_rwnd): 106496" size="4" value="0001a000"/> + <field name="sctp.sack_number_of_gap_blocks" pos="58" show="0" showname="Number of gap acknowledgement blocks: 0" size="2" value="0000"/> + <field name="sctp.sack_number_of_duplicated_tsns" pos="60" show="0" showname="Number of duplicated TSNs: 0" size="2" value="0000"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 176: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:24.530270000" showname="Arrival Time: Sep 25, 2015 16:35:24.530270000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191724.530270000" showname="Epoch Time: 1443191724.530270000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.030375000" showname="Time delta from previous captured frame: 0.030375000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.030375000" showname="Time delta from previous displayed frame: 0.030375000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="78.064639000" showname="Time since reference or first frame: 78.064639000 seconds" size="0"/> + <field name="frame.number" pos="0" show="176" showname="Frame Number: 176" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fed" showname="Header checksum: 0x9fed [validation disabled]" size="2" value="9fed"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fed"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fed"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x73ac7bca" showname="Checksum: 0x73ac7bca (not verified)" size="4" value="73ac7bca"/> + <field name="" pos="46" show="HEARTBEAT chunk (Information: 48 bytes)" size="52" value="040000340001003002008e3cc0a80cd5000000000000000000000000000000000000000060313300010000008db53fb930a0b65f"> + <field name="sctp.chunk_type" pos="46" show="4" showname="Chunk type: HEARTBEAT (4)" size="1" value="04"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="04" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="04" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80cd5000000000000000000000000000000000000000060313300010000008db53fb930a0b65f"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:60:31:33:00:01:00:00:00:8d:b5:3f:b9:30:a0:b6:5f" showname="Heartbeat information: 02008e3cc0a80cd500000000000000000000000000000000..." size="44" value="02008e3cc0a80cd5000000000000000000000000000000000000000060313300010000008db53fb930a0b65f"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 177: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:24.530415000" showname="Arrival Time: Sep 25, 2015 16:35:24.530415000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191724.530415000" showname="Epoch Time: 1443191724.530415000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000145000" showname="Time delta from previous captured frame: 0.000145000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000145000" showname="Time delta from previous displayed frame: 0.000145000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="78.064784000" showname="Time since reference or first frame: 78.064784000 seconds" size="0"/> + <field name="frame.number" pos="0" show="177" showname="Frame Number: 177" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x000c" showname="Identification: 0x000c (12)" size="2" value="000c"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fe1" showname="Header checksum: 0x9fe1 [validation disabled]" size="2" value="9fe1"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fe1"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fe1"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x417510b2" showname="Checksum: 0x417510b2 (not verified)" size="4" value="417510b2"/> + <field name="" pos="46" show="HEARTBEAT_ACK chunk (Information: 48 bytes)" size="52" value="050000340001003002008e3cc0a80cd5000000000000000000000000000000000000000060313300010000008db53fb930a0b65f"> + <field name="sctp.chunk_type" pos="46" show="5" showname="Chunk type: HEARTBEAT_ACK (5)" size="1" value="05"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="05" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="05" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80cd5000000000000000000000000000000000000000060313300010000008db53fb930a0b65f"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:60:31:33:00:01:00:00:00:8d:b5:3f:b9:30:a0:b6:5f" showname="Heartbeat information: 02008e3cc0a80cd500000000000000000000000000000000..." size="44" value="02008e3cc0a80cd5000000000000000000000000000000000000000060313300010000008db53fb930a0b65f"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 185: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:25.005065000" showname="Arrival Time: Sep 25, 2015 16:35:25.005065000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191725.005065000" showname="Epoch Time: 1443191725.005065000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.087558000" showname="Time delta from previous captured frame: 0.087558000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.087558000" showname="Time delta from previous displayed frame: 0.087558000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="78.539434000" showname="Time since reference or first frame: 78.539434000 seconds" size="0"/> + <field name="frame.number" pos="0" show="185" showname="Frame Number: 185" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x000d" showname="Identification: 0x000d (13)" size="2" value="000d"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fe0" showname="Header checksum: 0x9fe0 [validation disabled]" size="2" value="9fe0"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fe0"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fe0"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xac07ffbc" showname="Checksum: 0xac07ffbc (not verified)" size="4" value="ac07ffbc"/> + <field name="" pos="46" show="HEARTBEAT chunk (Information: 48 bytes)" size="52" value="040000340001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180292314010000007730e920aa62f65b"> + <field name="sctp.chunk_type" pos="46" show="4" showname="Chunk type: HEARTBEAT (4)" size="1" value="04"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="04" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="04" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180292314010000007730e920aa62f65b"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:11:00:00:00:00:00:00:00:00:00:74:59:d1:00:88:ff:ff:1e:20:1d:81:80:29:23:14:01:00:00:00:77:30:e9:20:aa:62:f6:5b" showname="Heartbeat information: 02008e3cc0a80c110000000000000000007459d10088ffff..." size="44" value="02008e3cc0a80c110000000000000000007459d10088ffff1e201d8180292314010000007730e920aa62f65b"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 186: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:25.005098000" showname="Arrival Time: Sep 25, 2015 16:35:25.005098000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191725.005098000" showname="Epoch Time: 1443191725.005098000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000033000" showname="Time delta from previous captured frame: 0.000033000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000033000" showname="Time delta from previous displayed frame: 0.000033000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="78.539467000" showname="Time since reference or first frame: 78.539467000 seconds" size="0"/> + <field name="frame.number" pos="0" show="186" showname="Frame Number: 186" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fed" showname="Header checksum: 0x9fed [validation disabled]" size="2" value="9fed"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fed"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fed"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x9ede94c4" showname="Checksum: 0x9ede94c4 (not verified)" size="4" value="9ede94c4"/> + <field name="" pos="46" show="HEARTBEAT_ACK chunk (Information: 48 bytes)" size="52" value="050000340001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180292314010000007730e920aa62f65b"> + <field name="sctp.chunk_type" pos="46" show="5" showname="Chunk type: HEARTBEAT_ACK (5)" size="1" value="05"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="05" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="05" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180292314010000007730e920aa62f65b"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:11:00:00:00:00:00:00:00:00:00:74:59:d1:00:88:ff:ff:1e:20:1d:81:80:29:23:14:01:00:00:00:77:30:e9:20:aa:62:f6:5b" showname="Heartbeat information: 02008e3cc0a80c110000000000000000007459d10088ffff..." size="44" value="02008e3cc0a80c110000000000000000007459d10088ffff1e201d8180292314010000007730e920aa62f65b"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 421: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:55.122133000" showname="Arrival Time: Sep 25, 2015 16:35:55.122133000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191755.122133000" showname="Epoch Time: 1443191755.122133000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.163967000" showname="Time delta from previous captured frame: 0.163967000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.163967000" showname="Time delta from previous displayed frame: 0.163967000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="108.656502000" showname="Time since reference or first frame: 108.656502000 seconds" size="0"/> + <field name="frame.number" pos="0" show="421" showname="Frame Number: 421" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fed" showname="Header checksum: 0x9fed [validation disabled]" size="2" value="9fed"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fed"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fed"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x9232c2ba" showname="Checksum: 0x9232c2ba (not verified)" size="4" value="9232c2ba"/> + <field name="" pos="46" show="HEARTBEAT chunk (Information: 48 bytes)" size="52" value="040000340001003002008e3cc0a80cd50000000000000000000000000000000000000000404f3300010000008db53fb930a0b65f"> + <field name="sctp.chunk_type" pos="46" show="4" showname="Chunk type: HEARTBEAT (4)" size="1" value="04"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="04" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="04" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80cd50000000000000000000000000000000000000000404f3300010000008db53fb930a0b65f"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:40:4f:33:00:01:00:00:00:8d:b5:3f:b9:30:a0:b6:5f" showname="Heartbeat information: 02008e3cc0a80cd500000000000000000000000000000000..." size="44" value="02008e3cc0a80cd50000000000000000000000000000000000000000404f3300010000008db53fb930a0b65f"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 422: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:55.122270000" showname="Arrival Time: Sep 25, 2015 16:35:55.122270000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191755.122270000" showname="Epoch Time: 1443191755.122270000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000137000" showname="Time delta from previous captured frame: 0.000137000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000137000" showname="Time delta from previous displayed frame: 0.000137000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="108.656639000" showname="Time since reference or first frame: 108.656639000 seconds" size="0"/> + <field name="frame.number" pos="0" show="422" showname="Frame Number: 422" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x000e" showname="Identification: 0x000e (14)" size="2" value="000e"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fdf" showname="Header checksum: 0x9fdf [validation disabled]" size="2" value="9fdf"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fdf"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fdf"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xa0eba9c2" showname="Checksum: 0xa0eba9c2 (not verified)" size="4" value="a0eba9c2"/> + <field name="" pos="46" show="HEARTBEAT_ACK chunk (Information: 48 bytes)" size="52" value="050000340001003002008e3cc0a80cd50000000000000000000000000000000000000000404f3300010000008db53fb930a0b65f"> + <field name="sctp.chunk_type" pos="46" show="5" showname="Chunk type: HEARTBEAT_ACK (5)" size="1" value="05"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="05" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="05" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80cd50000000000000000000000000000000000000000404f3300010000008db53fb930a0b65f"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:d5:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:40:4f:33:00:01:00:00:00:8d:b5:3f:b9:30:a0:b6:5f" showname="Heartbeat information: 02008e3cc0a80cd500000000000000000000000000000000..." size="44" value="02008e3cc0a80cd50000000000000000000000000000000000000000404f3300010000008db53fb930a0b65f"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 426: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:56.493553000" showname="Arrival Time: Sep 25, 2015 16:35:56.493553000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191756.493553000" showname="Epoch Time: 1443191756.493553000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.655441000" showname="Time delta from previous captured frame: 0.655441000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.655441000" showname="Time delta from previous displayed frame: 0.655441000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="110.027922000" showname="Time since reference or first frame: 110.027922000 seconds" size="0"/> + <field name="frame.number" pos="0" show="426" showname="Frame Number: 426" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x000f" showname="Identification: 0x000f (15)" size="2" value="000f"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fde" showname="Header checksum: 0x9fde [validation disabled]" size="2" value="9fde"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fde"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fde"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xe0a1e658" showname="Checksum: 0xe0a1e658 (not verified)" size="4" value="e0a1e658"/> + <field name="" pos="46" show="HEARTBEAT chunk (Information: 48 bytes)" size="52" value="040000340001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180a42314010000007730e920aa62f65b"> + <field name="sctp.chunk_type" pos="46" show="4" showname="Chunk type: HEARTBEAT (4)" size="1" value="04"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="04" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="04" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180a42314010000007730e920aa62f65b"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:11:00:00:00:00:00:00:00:00:00:74:59:d1:00:88:ff:ff:1e:20:1d:81:80:a4:23:14:01:00:00:00:77:30:e9:20:aa:62:f6:5b" showname="Heartbeat information: 02008e3cc0a80c110000000000000000007459d10088ffff..." size="44" value="02008e3cc0a80c110000000000000000007459d10088ffff1e201d8180a42314010000007730e920aa62f65b"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 427: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:35:56.493586000" showname="Arrival Time: Sep 25, 2015 16:35:56.493586000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191756.493586000" showname="Epoch Time: 1443191756.493586000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000033000" showname="Time delta from previous captured frame: 0.000033000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000033000" showname="Time delta from previous displayed frame: 0.000033000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="110.027955000" showname="Time since reference or first frame: 110.027955000 seconds" size="0"/> + <field name="frame.number" pos="0" show="427" showname="Frame Number: 427" size="0"/> + <field name="frame.len" pos="0" show="98" showname="Frame Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="98" showname="Capture Length: 98 bytes (784 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="84" showname="Total Length: 84" size="2" value="0054"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0x9fed" showname="Header checksum: 0x9fed [validation disabled]" size="2" value="9fed"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="9fed"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="9fed"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="64"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xd2788d20" showname="Checksum: 0xd2788d20 (not verified)" size="4" value="d2788d20"/> + <field name="" pos="46" show="HEARTBEAT_ACK chunk (Information: 48 bytes)" size="52" value="050000340001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180a42314010000007730e920aa62f65b"> + <field name="sctp.chunk_type" pos="46" show="5" showname="Chunk type: HEARTBEAT_ACK (5)" size="1" value="05"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="05" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="05" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="52" showname="Chunk length: 52" size="2" value="0034"/> + <field name="" pos="50" show="Heartbeat info parameter (Information: 44 bytes)" size="48" value="0001003002008e3cc0a80c110000000000000000007459d10088ffff1e201d8180a42314010000007730e920aa62f65b"> + <field name="sctp.parameter_type" pos="50" show="0x0001" showname="Parameter type: Heartbeat info (0x0001)" size="2" value="0001"> + <field name="sctp.parameter_bit_1" pos="50" show="0" showname="0... .... .... .... = Bit: Stop processing of chunk" size="2" unmaskedvalue="0001" value="0"/> + <field name="sctp.parameter_bit_2" pos="50" show="0" showname=".0.. .... .... .... = Bit: Do not report" size="2" unmaskedvalue="0001" value="0"/> + </field> + <field name="sctp.parameter_length" pos="52" show="48" showname="Parameter length: 48" size="2" value="0030"/> + <field name="sctp.parameter_heartbeat_information" pos="54" show="02:00:8e:3c:c0:a8:0c:11:00:00:00:00:00:00:00:00:00:74:59:d1:00:88:ff:ff:1e:20:1d:81:80:a4:23:14:01:00:00:00:77:30:e9:20:aa:62:f6:5b" showname="Heartbeat information: 02008e3cc0a80c110000000000000000007459d10088ffff..." size="44" value="02008e3cc0a80c110000000000000000007459d10088ffff1e201d8180a42314010000007730e920aa62f65b"/> + </field> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 491: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0" size="54"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:36:14.355024000" showname="Arrival Time: Sep 25, 2015 16:36:14.355024000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191774.355024000" showname="Epoch Time: 1443191774.355024000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.484347000" showname="Time delta from previous captured frame: 0.484347000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.484347000" showname="Time delta from previous displayed frame: 0.484347000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="127.889393000" showname="Time since reference or first frame: 127.889393000 seconds" size="0"/> + <field name="frame.number" pos="0" show="491" showname="Frame Number: 491" size="0"/> + <field name="frame.len" pos="0" show="54" showname="Frame Length: 54 bytes (432 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="54" showname="Capture Length: 54 bytes (432 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="40" showname="Total Length: 40" size="2" value="0028"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa019" showname="Header checksum: 0xa019 [validation disabled]" size="2" value="a019"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a019"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a019"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="20"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xd469a110" showname="Checksum: 0xd469a110 (not verified)" size="4" value="d469a110"/> + <field name="" pos="46" show="SHUTDOWN chunk (Cumulative TSN ack: 3304831198)" size="8" value="07000008c4fbb8de"> + <field name="sctp.chunk_type" pos="46" show="7" showname="Chunk type: SHUTDOWN (7)" size="1" value="07"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="07" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="07" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="8" showname="Chunk length: 8" size="2" value="0008"/> + <field name="sctp.shutdown_cumulative_tsn_ack" pos="50" show="3304831198" showname="Cumulative TSN Ack: 3304831198" size="4" value="c4fbb8de"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 492: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0" size="60"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:36:14.355162000" showname="Arrival Time: Sep 25, 2015 16:36:14.355162000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191774.355162000" showname="Epoch Time: 1443191774.355162000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000138000" showname="Time delta from previous captured frame: 0.000138000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000138000" showname="Time delta from previous displayed frame: 0.000138000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="127.889531000" showname="Time since reference or first frame: 127.889531000 seconds" size="0"/> + <field name="frame.number" pos="0" show="492" showname="Frame Number: 492" size="0"/> + <field name="frame.len" pos="0" show="60" showname="Frame Length: 60 bytes (480 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="60" showname="Capture Length: 60 bytes (480 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.213 (192.168.12.213), Dst: 192.168.12.17 (192.168.12.17)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="36" showname="Total Length: 36" size="2" value="0024"/> + <field name="ip.id" pos="18" show="0x0010" showname="Identification: 0x0010 (16)" size="2" value="0010"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa00d" showname="Header checksum: 0xa00d [validation disabled]" size="2" value="a00d"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a00d"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a00d"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.213" showname="Source: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.213" showname="Source Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="ip.dst" pos="30" show="192.168.12.17" showname="Destination: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.17" showname="Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80cd5"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80c11"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="16"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x4cd1eca0" showname="Verification tag: 0x4cd1eca0" size="4" value="4cd1eca0"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0xe21454e0" showname="Checksum: 0xe21454e0 (not verified)" size="4" value="e21454e0"/> + <field name="" pos="46" show="SHUTDOWN_ACK chunk" size="4" value="08000004"> + <field name="sctp.chunk_type" pos="46" show="8" showname="Chunk type: SHUTDOWN_ACK (8)" size="1" value="08"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="08" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="08" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"/> + <field name="sctp.chunk_length" pos="48" show="4" showname="Chunk length: 4" size="2" value="0004"/> + </field> + </proto> + </proto> + </proto> + </packet> + <packet> + <proto name="frame" pos="0" showname="Frame 493: 50 bytes on wire (400 bits), 50 bytes captured (400 bits) on interface 0" size="50"> + <field name="frame.interface_id" pos="0" show="0" showname="Interface id: 0" size="0"/> + <field name="frame.encap_type" pos="0" show="1" showname="Encapsulation type: Ethernet (1)" size="0"/> + <field name="frame.time" pos="0" show="Sep 25, 2015 16:36:14.355191000" showname="Arrival Time: Sep 25, 2015 16:36:14.355191000 CEST" size="0"/> + <field name="frame.offset_shift" pos="0" show="0.000000000" showname="Time shift for this packet: 0.000000000 seconds" size="0"/> + <field name="frame.time_epoch" pos="0" show="1443191774.355191000" showname="Epoch Time: 1443191774.355191000 seconds" size="0"/> + <field name="frame.time_delta" pos="0" show="0.000029000" showname="Time delta from previous captured frame: 0.000029000 seconds" size="0"/> + <field name="frame.time_delta_displayed" pos="0" show="0.000029000" showname="Time delta from previous displayed frame: 0.000029000 seconds" size="0"/> + <field name="frame.time_relative" pos="0" show="127.889560000" showname="Time since reference or first frame: 127.889560000 seconds" size="0"/> + <field name="frame.number" pos="0" show="493" showname="Frame Number: 493" size="0"/> + <field name="frame.len" pos="0" show="50" showname="Frame Length: 50 bytes (400 bits)" size="0"/> + <field name="frame.cap_len" pos="0" show="50" showname="Capture Length: 50 bytes (400 bits)" size="0"/> + <field name="frame.marked" pos="0" show="0" showname="Frame is marked: False" size="0"/> + <field name="frame.ignored" pos="0" show="0" showname="Frame is ignored: False" size="0"/> + <field name="frame.protocols" pos="0" show="eth:ip:sctp" showname="Protocols in frame: eth:ip:sctp" size="0"/> + <proto name="ip" pos="14" showname="Internet Protocol Version 4, Src: 192.168.12.17 (192.168.12.17), Dst: 192.168.12.213 (192.168.12.213)" size="20"> + <field name="ip.version" pos="14" show="4" showname="Version: 4" size="1" value="45"/> + <field name="ip.hdr_len" pos="14" show="20" showname="Header length: 20 bytes" size="1" value="45"/> + <field name="ip.dsfield" pos="15" show="2" showname="Differentiated Services Field: 0x02 (DSCP 0x00: Default; ECN: 0x02: ECT(0) (ECN-Capable Transport))" size="1" value="02"> + <field name="ip.dsfield.dscp" pos="15" show="0x00" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" unmaskedvalue="02" value="0"/> + <field name="ip.dsfield.ecn" pos="15" show="0x02" showname=".... ..10 = Explicit Congestion Notification: ECT(0) (ECN-Capable Transport) (0x02)" size="1" unmaskedvalue="02" value="2"/> + </field> + <field name="ip.len" pos="16" show="36" showname="Total Length: 36" size="2" value="0024"/> + <field name="ip.id" pos="18" show="0x0000" showname="Identification: 0x0000 (0)" size="2" value="0000"/> + <field name="ip.flags" pos="20" show="0x02" showname="Flags: 0x02 (Don't Fragment)" size="1" value="40"> + <field name="ip.flags.rb" pos="20" show="0" showname="0... .... = Reserved bit: Not set" size="1" value="40"/> + <field name="ip.flags.df" pos="20" show="1" showname=".1.. .... = Don't fragment: Set" size="1" value="40"/> + <field name="ip.flags.mf" pos="20" show="0" showname="..0. .... = More fragments: Not set" size="1" value="40"/> + </field> + <field name="ip.frag_offset" pos="20" show="0" showname="Fragment offset: 0" size="2" value="4000"/> + <field name="ip.ttl" pos="22" show="64" showname="Time to live: 64" size="1" value="40"/> + <field name="ip.proto" pos="23" show="132" showname="Protocol: SCTP (132)" size="1" value="84"/> + <field name="ip.checksum" pos="24" show="0xa01d" showname="Header checksum: 0xa01d [validation disabled]" size="2" value="a01d"> + <field name="ip.checksum_good" pos="24" show="0" showname="Good: False" size="2" value="a01d"/> + <field name="ip.checksum_bad" pos="24" show="0" showname="Bad: False" size="2" value="a01d"/> + </field> + <field name="ip.src" pos="26" show="192.168.12.17" showname="Source: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.addr" pos="26" show="192.168.12.17" showname="Source or Destination Address: 192.168.12.17 (192.168.12.17)" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.src_host" pos="26" show="192.168.12.17" showname="Source Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field hide="yes" name="ip.host" pos="26" show="192.168.12.17" showname="Source or Destination Host: 192.168.12.17" size="4" value="c0a80c11"/> + <field name="ip.dst" pos="30" show="192.168.12.213" showname="Destination: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.addr" pos="30" show="192.168.12.213" showname="Source or Destination Address: 192.168.12.213 (192.168.12.213)" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.dst_host" pos="30" show="192.168.12.213" showname="Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field hide="yes" name="ip.host" pos="30" show="192.168.12.213" showname="Source or Destination Host: 192.168.12.213" size="4" value="c0a80cd5"/> + <field name="" pos="26" show="Source GeoIP: Unknown" size="4" value="c0a80c11"/> + <field name="" pos="30" show="Destination GeoIP: Unknown" size="4" value="c0a80cd5"/> + <proto name="sctp" pos="34" showname="Stream Control Transmission Protocol, Src Port: s1-control (36412), Dst Port: s1-control (36412)" size="16"> + <field name="sctp.srcport" pos="34" show="36412" showname="Source port: 36412" size="2" value="8e3c"/> + <field name="sctp.dstport" pos="36" show="36412" showname="Destination port: 36412" size="2" value="8e3c"/> + <field name="sctp.verification_tag" pos="38" show="0x54f837ab" showname="Verification tag: 0x54f837ab" size="4" value="54f837ab"/> + <field hide="yes" name="sctp.port" pos="34" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field hide="yes" name="sctp.port" pos="36" show="36412" showname="Port: 36412" size="2" value="8e3c"/> + <field name="sctp.checksum" pos="42" show="0x29068146" showname="Checksum: 0x29068146 (not verified)" size="4" value="29068146"/> + <field name="" pos="46" show="SHUTDOWN_COMPLETE chunk" size="4" value="0e000004"> + <field name="sctp.chunk_type" pos="46" show="14" showname="Chunk type: SHUTDOWN_COMPLETE (14)" size="1" value="0e"> + <field name="sctp.chunk_bit_1" pos="46" show="0" showname="0... .... = Bit: Stop processing of the packet" size="1" unmaskedvalue="0e" value="0"/> + <field name="sctp.chunk_bit_2" pos="46" show="0" showname=".0.. .... = Bit: Do not report" size="1" unmaskedvalue="0e" value="0"/> + </field> + <field name="sctp.chunk_flags" pos="47" show="0x00" showname="Chunk flags: 0x00" size="1" value="00"> + <field name="sctp.shutdown_complete_t_bit" pos="47" show="0" showname=".... ...0 = T-Bit: Tag not reflected" size="1" unmaskedvalue="00" value="0"/> + </field> + <field name="sctp.chunk_length" pos="48" show="4" showname="Chunk length: 4" size="2" value="0004"/> + </field> + </proto> + </proto> + </proto> + </packet> +</pdml> diff --git a/openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/enb.band7.tm1.usrpb210.epc.local.conf b/openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/enb.band7.tm1.usrpb210.epc.local.conf new file mode 100644 index 0000000000..e864f47edb --- /dev/null +++ b/openair3/TEST/EPC_TEST/TEST_1MME_1ENB_1UE_ATTACH_GUTI/enb.band7.tm1.usrpb210.epc.local.conf @@ -0,0 +1,174 @@ +Active_eNBs = ( "eNB_Eurecom_LTEBox"); +# Asn1_verbosity, choice in: none, info, annoying +Asn1_verbosity = "none"; + +eNBs = +( + { + ////////// Identification parameters: + eNB_ID = 0xe00; + + cell_type = "CELL_MACRO_ENB"; + + eNB_name = "eNB_Eurecom_LTEBox"; + + // Tracking area code, 0x0000 and 0xfffe are reserved values + tracking_area_code = "1"; + + mobile_country_code = "208"; + + mobile_network_code = "95"; + + ////////// Physical parameters: + + component_carriers = ( + { + frame_type = "FDD"; + tdd_config = 3; + tdd_config_s = 0; + prefix_type = "NORMAL"; + eutra_band = 7; + downlink_frequency = 2660000000L; + uplink_frequency_offset = -120000000; + Nid_cell = 0; + N_RB_DL = 25; + Nid_cell_mbsfn = 0; + nb_antennas_tx = 1; + nb_antennas_rx = 1; + tx_gain = 90; + rx_gain = 120; + prach_root = 0; + prach_config_index = 0; + prach_high_speed = "DISABLE"; + prach_zero_correlation = 1; + prach_freq_offset = 2; + pucch_delta_shift = 1; + pucch_nRB_CQI = 1; + pucch_nCS_AN = 0; + pucch_n1_AN = 32; + pdsch_referenceSignalPower = -26; + pdsch_p_b = 0; + pusch_n_SB = 1; + pusch_enable64QAM = "DISABLE"; + pusch_hoppingMode = "interSubFrame"; + pusch_hoppingOffset = 0; + pusch_groupHoppingEnabled = "ENABLE"; + pusch_groupAssignment = 0; + pusch_sequenceHoppingEnabled = "DISABLE"; + pusch_nDMRS1 = 1; + phich_duration = "NORMAL"; + phich_resource = "ONESIXTH"; + srs_enable = "DISABLE"; + /* srs_BandwidthConfig =; + srs_SubframeConfig =; + srs_ackNackST =; + srs_MaxUpPts =;*/ + + pusch_p0_Nominal = -90; + pusch_alpha = "AL1"; + pucch_p0_Nominal = -108; + msg3_delta_Preamble = 6; + pucch_deltaF_Format1 = "deltaF2"; + pucch_deltaF_Format1b = "deltaF3"; + pucch_deltaF_Format2 = "deltaF0"; + pucch_deltaF_Format2a = "deltaF0"; + pucch_deltaF_Format2b = "deltaF0"; + + rach_numberOfRA_Preambles = 64; + rach_preamblesGroupAConfig = "DISABLE"; + /* + rach_sizeOfRA_PreamblesGroupA = ; + rach_messageSizeGroupA = ; + rach_messagePowerOffsetGroupB = ; + */ + rach_powerRampingStep = 4; + rach_preambleInitialReceivedTargetPower = -108; + rach_preambleTransMax = 10; + rach_raResponseWindowSize = 10; + rach_macContentionResolutionTimer = 48; + rach_maxHARQ_Msg3Tx = 4; + + pcch_default_PagingCycle = 128; + pcch_nB = "oneT"; + bcch_modificationPeriodCoeff = 2; + ue_TimersAndConstants_t300 = 1000; + ue_TimersAndConstants_t301 = 1000; + ue_TimersAndConstants_t310 = 1000; + ue_TimersAndConstants_t311 = 10000; + ue_TimersAndConstants_n310 = 20; + ue_TimersAndConstants_n311 = 1; + } + ); + + srb1_parameters : + { + # timer_poll_retransmit = (ms) [5, 10, 15, 20,... 250, 300, 350, ... 500] + timer_poll_retransmit = 80; + + # timer_reordering = (ms) [0,5, ... 100, 110, 120, ... ,200] + timer_reordering = 35; + + # timer_reordering = (ms) [0,5, ... 250, 300, 350, ... ,500] + timer_status_prohibit = 0; + + # poll_pdu = [4, 8, 16, 32 , 64, 128, 256, infinity(>10000)] + poll_pdu = 4; + + # poll_byte = (kB) [25,50,75,100,125,250,375,500,750,1000,1250,1500,2000,3000,infinity(>10000)] + poll_byte = 99999; + + # max_retx_threshold = [1, 2, 3, 4 , 6, 8, 16, 32] + max_retx_threshold = 4; + } + + # ------- SCTP definitions + SCTP : + { + # Number of streams to use in input/output + SCTP_INSTREAMS = 2; + SCTP_OUTSTREAMS = 2; + }; + + + ////////// MME parameters: + mme_ip_address = ( { ipv4 = "192.188.2.2"; + ipv6 = "192:168:30::17"; + active = "yes"; + preference = "ipv4"; + } + ); + + NETWORK_INTERFACES : + { + ENB_INTERFACE_NAME_FOR_S1_MME = "tun2"; + ENB_IPV4_ADDRESS_FOR_S1_MME = "192.188.2.2/24"; + + ENB_INTERFACE_NAME_FOR_S1U = "lo"; + ENB_IPV4_ADDRESS_FOR_S1U = "127.0.0.1/24"; + ENB_PORT_FOR_S1U = 2153; # Spec 2152 + }; + + log_config : + { + global_log_level ="info"; + global_log_verbosity ="medium"; + hw_log_level ="info"; + hw_log_verbosity ="medium"; + phy_log_level ="info"; + phy_log_verbosity ="medium"; + mac_log_level ="info"; + mac_log_verbosity ="high"; + rlc_log_level ="info"; + rlc_log_verbosity ="medium"; + pdcp_log_level ="info"; + pdcp_log_verbosity ="medium"; + rrc_log_level ="info"; + rrc_log_verbosity ="medium"; + gtpu_log_level ="info"; + gtpu_log_verbosity ="medium"; + udp_log_level ="info"; + udp_log_verbosity ="medium"; + }; + + } +); diff --git a/openair3/TEST/EPC_TEST/generate_scenario.c b/openair3/TEST/EPC_TEST/generate_scenario.c index 6843766f95..eff91ea56f 100644 --- a/openair3/TEST/EPC_TEST/generate_scenario.c +++ b/openair3/TEST/EPC_TEST/generate_scenario.c @@ -43,6 +43,9 @@ #include <unistd.h> #include <errno.h> #include <fcntl.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <unistd.h> #include <libxml/xmlmemory.h> #include <libxml/debugXML.h> #include <libxml/HTMLtree.h> @@ -95,11 +98,64 @@ #define ENB_CONFIG_MAX_XSLT_PARAMS 64 Enb_properties_array_t g_enb_properties[2]; -char *g_test_dir = "."; // default value -char *g_pdml_in_basename = "trace.pdml"; // default value +char *g_openair_dir = NULL; +char *g_test_dir = NULL; +char *g_pdml_in_origin = NULL; +char *g_generic_scenario = NULL; extern int xmlLoadExtDtdDefaultValue; + +#define GENERATE_PDML_FILE 1 +#define GENERATE_GENERIC_SCENARIO 2 +#define GENERATE_DEDICATED_SCENARIO 4 + +#define GS_IS_FILE 1 +#define GS_IS_DIR 2 + +//------------------------------------------------------------------------------ +// test if file exist in current directory +int is_file_exists( const char const * file_nameP, const char const *file_roleP) +{ + struct stat s; + int err = stat(file_nameP, &s); + if(-1 == err) { + if(ENOENT == errno) { + fprintf(stderr, "Please provide a valid %s, %s does not exist\n", file_roleP, file_nameP); + } else { + perror("stat"); + exit(1); + } + } else { + if(S_ISREG(s.st_mode)) { + return GS_IS_FILE; + } else if(S_ISDIR(s.st_mode)) { + return GS_IS_DIR; + } else { + fprintf(stderr, "Please provide a valid test %s, %s exists but is not found valid\n", file_roleP, file_nameP); + } + } + return 0; +} + //------------------------------------------------------------------------------ -void generate_scenario(const char const * pdml_in_basenameP) +// return number of splitted items +int split_path( char * pathP, char *** resP) +{ + char * saveptr1; + char * p = strtok_r (pathP, "/", &saveptr1); + int n_spaces = 0; + + /// split string and append tokens to 'res' + while (p) { + *resP = realloc (*resP, sizeof (char*) * ++n_spaces); + AssertFatal (*resP, "realloc failed"); + (*resP)[n_spaces-1] = p; + p = strtok_r (NULL, "/", &saveptr1); + } + return n_spaces; +} + +//------------------------------------------------------------------------------ +void generate_generic_scenario(const char const * test_nameP, const char const * pdml_in_basenameP) //------------------------------------------------------------------------------ { //int fd_pdml_in; @@ -107,33 +163,58 @@ void generate_scenario(const char const * pdml_in_basenameP) xmlDocPtr doc, res; const char *params[ENB_CONFIG_MAX_XSLT_PARAMS]; int nb_params = 0; + int i,j; + char astring[1024]; + struct in_addr addr; - if (chdir(g_test_dir) == 0) { - printf( "working in %s directory\n", g_test_dir); - /*fd_pdml_in = open(pdml_in_basenameP, O_RDONLY); - AssertFatal (fd_pdml_in > 0, - "Error while opening %s file in directory %s\n", - pdml_in_basenameP, - g_test_dir);*/ - - params[nb_params] = NULL; - xmlSubstituteEntitiesDefault(1); - xmlLoadExtDtdDefaultValue = 1; - cur = xsltParseStylesheetFile("enb_config.xsl"); - doc = xmlParseFile(pdml_in_basenameP); - res = xsltApplyStylesheet(cur, doc, params); - xsltSaveResultToFile(stdout, res, cur); - - xsltFreeStylesheet(cur); - xmlFreeDoc(res); - xmlFreeDoc(doc); - - xsltCleanupGlobals(); - xmlCleanupParser(); + memset(astring, 0, sizeof(astring)); + if (getcwd(astring, sizeof(astring)) != NULL) { + fprintf(stdout, "working in %s directory\n", astring); } else { - printf("Error: chdir %s returned %s\n", g_test_dir, strerror(errno)); - exit(-1); + perror("getcwd() error"); + exit(1); + } + + memset(astring, 0, sizeof(astring)); + strcat(astring, g_openair_dir); + strcat(astring, "/openair3/TEST/EPC_TEST/generic_scenario.xsl"); + + xmlSubstituteEntitiesDefault(1); + xmlLoadExtDtdDefaultValue = 1; + cur = xsltParseStylesheetFile(astring); + doc = xmlParseFile(pdml_in_basenameP); + params[nb_params++] = "test_name"; + sprintf(astring, "\"%s\"", test_nameP); + params[nb_params++] = strdup(astring); + + for (i = 0; i < g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD].number; i++) { + // eNB S1-C IPv4 address + sprintf(astring, "enb_s1c%d", i); + params[nb_params++] = strdup(astring); + addr.s_addr = g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD].properties[i]->enb_ipv4_address_for_S1_MME; + sprintf(astring, "\"%s\"", inet_ntoa(addr)); + params[nb_params++] = strdup(astring); + + // MME S1-C IPv4 address + for (j = 0; j < g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD].properties[i]->nb_mme; j++) { + sprintf(astring, "mme_s1c%d_%d", i, j); + params[nb_params++] = strdup(astring); + AssertFatal (g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD].properties[i]->mme_ip_address[j].ipv4_address, + "Only support MME IPv4 address\n"); + sprintf(astring, "\"%s\"", g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD].properties[i]->mme_ip_address[j].ipv4_address); + params[nb_params++] = strdup(astring); + } } + params[nb_params] = NULL; + res = xsltApplyStylesheet(cur, doc, params); + xsltSaveResultToFile(stdout, res, cur); + + xsltFreeStylesheet(cur); + xmlFreeDoc(res); + xmlFreeDoc(doc); + + xsltCleanupGlobals(); + xmlCleanupParser(); } //------------------------------------------------------------------------------ @@ -403,14 +484,77 @@ static void usage ( { fprintf (stdout, "Please report any bug to: openair4g-devel@lists.eurecom.fr\n\n"); fprintf (stdout, "Usage: %s [options]\n\n", argv[0]); + fprintf (stdout, "Mandatory options:\n"); + fprintf (stdout, "\t-t | --test-dir <dir> Directory where a set of files related to a particular test are located\n"); + fprintf (stdout, "\n"); fprintf (stdout, "Available options:\n"); - fprintf (stdout, "\t--help, -h Print this help and return\n"); - fprintf (stdout, "\t--new-enb-conf-file <file>\n"); - fprintf (stdout, " Provide an updated eNB config file for generating a copy of the original test\n"); - fprintf (stdout, " This option is set as many times as there are some eNB config files in the original test\n"); - fprintf (stdout, "\t--old-enb-conf-file <file>\n"); - fprintf (stdout, " Provide the old eNB config file for generating a copy of the original test\n"); - fprintf (stdout, " This option is set as many times as there are some eNB config files in the original test\n"); + fprintf (stdout, "\t-h | --help Print this help and return\n"); + fprintf (stdout, "\t-n | --new-enb-conf-file <file> Provide an updated eNB config file for generating a copy of the original test\n"); + fprintf (stdout, " This option is set as many times as there are some eNB config files in the original test\n"); + fprintf (stdout, "\t-o | --old-enb-conf-file <file> Provide the old eNB config file for generating a copy of the original test\n"); + fprintf (stdout, " This option is set as many times as there are some eNB config files in the original test\n"); + fprintf (stdout, "\t-p | --pdml <file> File name (with no path) of an original scenario that has to be reworked (IP addresses) with new testbed\n"); + fprintf (stdout, "\t-s | --scenario-generic <file> File name (with no path) of a scenario that has to be customized (IP addresses) with new testbed\n"); + fprintf (stdout, "\n"); + fprintf (stdout, "\n"); + fprintf (stdout, "Example of generate_scenario use cases: \n"); + fprintf (stdout, "\n"); + fprintf (stdout, " Case 1: generate a generix xml scenario from a captured pcap file: \n"); + fprintf (stdout, " +---------------------+ \n"); + fprintf (stdout, " |captured pcap-ng file| \n"); + fprintf (stdout, " +----------+----------+ \n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " mme_test_s1_pcap2pdml \n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " +--------V----------+ +------------------------+\n"); + fprintf (stdout, " |'pdml-in-orig' file| |'old-enb-conf-file' file|\n"); + fprintf (stdout, " +--------+----------+ +------------+-----------+\n"); + fprintf (stdout, " | |\n"); + fprintf (stdout, " +----------------------------+\n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " generate_scenario -t <dir> -p <file> -o <file> \n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " +------------V--------------+\n"); + fprintf (stdout, " +'xml-scenario-generic' file|\n"); + fprintf (stdout, " +---------------------------+\n"); + fprintf (stdout, "\n"); + fprintf (stdout, "\n"); + fprintf (stdout, " Case 2: generate a dedicated xml scenario from generic xml scenario:\n"); + fprintf (stdout, "\n"); + fprintf (stdout, " +---------------------------+ +------------------------+\n"); + fprintf (stdout, " |'xml-scenario-generic' file| |'new-enb-conf-file' file|\n"); + fprintf (stdout, " +--------+------------------+ +------------+-----------+\n"); + fprintf (stdout, " | |\n"); + fprintf (stdout, " +--------------------+---------------+\n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " generate_scenario -t <dir> -s <file> -n <file> \n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " +--------------V--------------+\n"); + fprintf (stdout, " +'xml-scenario-dedicated' file|\n"); + fprintf (stdout, " +-----------------------------+\n"); + fprintf (stdout, "\n"); + fprintf (stdout, "\n"); + fprintf (stdout, " Case 3 = case 1 + case 2: generate a dedicated xml scenario from a captured pcap file:\n"); + fprintf (stdout, "\n"); + fprintf (stdout, " +---------------------+\n"); + fprintf (stdout, " |captured pcap-ng file|\n"); + fprintf (stdout, " +----------+----------+\n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " mme_test_s1_pcap2pdml \n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " +------------------------+ +--------V----------+ +------------------------+\n"); + fprintf (stdout, " |'old-enb-conf-file' file| |'pdml-in-orig' file| |'new-enb-conf-file' file|\n"); + fprintf (stdout, " +------------+-----------+ +--------+----------+ +------------+-----------+\n"); + fprintf (stdout, " | | |\n"); + fprintf (stdout, " +----------------------+-------------------------+\n"); + fprintf (stdout, " |\n"); + fprintf (stdout, " V\n"); + fprintf (stdout, " generate_scenario -t <dir> -p <file> -o <file> -n <file> \n"); + fprintf (stdout, " | ^ |\n"); + fprintf (stdout, " | | |\n"); + fprintf (stdout, " +--------------V------------+ +------------V----------------+\n"); + fprintf (stdout, " |'xml-scenario-generic' file| |'xml-scenario-dedicated' file|\n"); + fprintf (stdout, " +---------------------------+ +-----------------------------+\n"); } @@ -422,20 +566,29 @@ config_parse_opt_line ( //------------------------------------------------------------------------------ { int option; - char *enb_config_file_name = NULL; + int rv = 0; + char *new_enb_config_file_name = NULL; + char *old_enb_config_file_name = NULL; + char *pdml_in_file_name = NULL; + char *generic_scenario_file_name = NULL; + char *test_dir_name = NULL; enum long_option_e { LONG_OPTION_START = 0x100, /* Start after regular single char options */ LONG_OPTION_NEW_ENB_CONF_FILE, LONG_OPTION_OLD_ENB_CONF_FILE, - LONG_OPTION_PDML_IN_BASENAME, + LONG_OPTION_PDML, + LONG_OPTION_TEST_DIR, + LONG_OPTION_SCENARIO_GENERIC, LONG_OPTION_HELP, }; static struct option long_options[] = { {"old-enb-conf-file", required_argument, 0, LONG_OPTION_OLD_ENB_CONF_FILE}, {"new-enb-conf-file", required_argument, 0, LONG_OPTION_NEW_ENB_CONF_FILE}, - {"pdml_in_basename", required_argument, 0, LONG_OPTION_PDML_IN_BASENAME}, + {"pdml ", required_argument, 0, LONG_OPTION_PDML}, + {"test-dir", required_argument, 0, LONG_OPTION_TEST_DIR}, + {"scenario-generic", required_argument, 0, LONG_OPTION_SCENARIO_GENERIC}, {"help", required_argument, 0, LONG_OPTION_HELP}, {NULL, 0, NULL, 0} }; @@ -443,32 +596,53 @@ config_parse_opt_line ( /* * Parsing command line */ - while ((option = getopt_long (argc, argv, "hp:n:o", long_options, NULL)) != -1) { + while ((option = getopt_long (argc, argv, "hp:n:o:s:t", long_options, NULL)) != -1) { switch (option) { case LONG_OPTION_OLD_ENB_CONF_FILE: case 'o': if (optarg) { - enb_config_file_name = optarg; - printf("Old eNB config file name is %s\n", enb_config_file_name); - enb_config_init(enb_config_file_name, ENB_CONFIG_PROPERTIES_INDEX_OLD); - g_test_dir = strdup(dirname(enb_config_file_name)); + old_enb_config_file_name = optarg; + printf("Old eNB config file name is %s\n", old_enb_config_file_name); + rv |= GENERATE_GENERIC_SCENARIO; } break; case LONG_OPTION_NEW_ENB_CONF_FILE: case 'n': if (optarg) { - enb_config_file_name = optarg; - printf("New eNB config file name is %s\n", enb_config_file_name); - enb_config_init(enb_config_file_name, ENB_CONFIG_PROPERTIES_INDEX_NEW); + new_enb_config_file_name = optarg; + printf("New eNB config file name is %s\n", new_enb_config_file_name); + rv |= GENERATE_DEDICATED_SCENARIO; } break; - case LONG_OPTION_PDML_IN_BASENAME: + case LONG_OPTION_PDML: case 'p': if (optarg) { - g_pdml_in_basename = strdup(optarg); - printf("PDML input file name is %s\n", g_pdml_in_basename); + pdml_in_file_name = strdup(optarg); + printf("PDML input file name is %s\n", pdml_in_file_name); + rv |= GENERATE_GENERIC_SCENARIO; + } + break; + + case LONG_OPTION_TEST_DIR: + case 't': + if (optarg) { + test_dir_name = strdup(optarg); + if (is_file_exists(test_dir_name, "test dirname") != GS_IS_DIR) { + fprintf(stderr, "Please provide a valid test dirname, %s is not a valid directory name\n", test_dir_name); + exit(1); + } + printf("Test dir name is %s\n", test_dir_name); + } + break; + + case LONG_OPTION_SCENARIO_GENERIC: + case 's': + if (optarg) { + generic_scenario_file_name = strdup(optarg); + printf("Generic XML scenario input file name is %s\n", generic_scenario_file_name); + rv |= GENERATE_DEDICATED_SCENARIO; } break; @@ -479,18 +653,77 @@ config_parse_opt_line ( exit (0); } } - return 0; + if (NULL == test_dir_name) { + fprintf(stderr, "Please provide a valid test dirname\n"); + exit(1); + } + g_test_dir = test_dir_name; test_dir_name = NULL; + if (chdir(g_test_dir) != 0) { + fprintf(stderr, "Error: chdir %s returned %s\n", g_test_dir, strerror(errno)); + exit(1); + } + if (rv & GENERATE_GENERIC_SCENARIO) { + if (NULL == old_enb_config_file_name) { + fprintf(stderr, "Error: please provide the original eNB config file name that should be in %s\n", g_test_dir); + } + if (is_file_exists(old_enb_config_file_name, "Old eNB config file") != GS_IS_FILE) { + fprintf(stderr, "Error: original eNB config file name %s is not found in dir %s\n", old_enb_config_file_name, g_test_dir); + } + enb_config_display(ENB_CONFIG_PROPERTIES_INDEX_OLD); + enb_config_init(old_enb_config_file_name, ENB_CONFIG_PROPERTIES_INDEX_OLD); + + if (NULL == pdml_in_file_name) { + fprintf(stderr, "Error: please provide the PDML file name that should be in %s\n", g_test_dir); + } + if (is_file_exists(pdml_in_file_name, "PDML file") != GS_IS_FILE) { + fprintf(stderr, "Error: PDML file name %s is not found in dir %s\n", pdml_in_file_name, g_test_dir); + } + g_pdml_in_origin = pdml_in_file_name; pdml_in_file_name = NULL; + } + + if (rv & GENERATE_DEDICATED_SCENARIO) { + if (NULL == new_enb_config_file_name) { + fprintf(stderr, "Error: please provide the new eNB config file name that should be in %s\n", g_test_dir); + } + if (is_file_exists(new_enb_config_file_name, "New eNB config file") != GS_IS_FILE) { + fprintf(stderr, "Error: New eNB config file name %s is not found in dir %s\n", new_enb_config_file_name, g_test_dir); + } + enb_config_display(ENB_CONFIG_PROPERTIES_INDEX_NEW); + enb_config_init(new_enb_config_file_name, ENB_CONFIG_PROPERTIES_INDEX_NEW); + + if (NULL == generic_scenario_file_name) { + fprintf(stderr, "Error: please provide the Generic scenario file name that should be in %s\n", g_test_dir); + } + if (is_file_exists(generic_scenario_file_name, "Generic scenario file") != GS_IS_FILE) { + fprintf(stderr, "Error: Generic scenario file name %s is not found in dir %s\n", generic_scenario_file_name, g_test_dir); + } + g_generic_scenario = generic_scenario_file_name; generic_scenario_file_name = NULL; + } + return rv; } //------------------------------------------------------------------------------ int main( int argc, char **argv ) //------------------------------------------------------------------------------ { + int actions = 0; + + g_openair_dir = getenv("OPENAIR_DIR"); + if (NULL == g_openair_dir) { + fprintf(stderr, "Error: Could not get OPENAIR_DIR environment variable\n"); + exit(1); + } + memset((char*) &g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD], 0 , sizeof(g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_OLD])); memset((char*) &g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_NEW], 0 , sizeof(g_enb_properties[ENB_CONFIG_PROPERTIES_INDEX_NEW])); - config_parse_opt_line (argc, argv); //Command-line options - enb_config_display(ENB_CONFIG_PROPERTIES_INDEX_OLD); - enb_config_display(ENB_CONFIG_PROPERTIES_INDEX_NEW); - generate_scenario(g_pdml_in_basename); + + actions = config_parse_opt_line (argc, argv); //Command-line options + if (actions & GENERATE_GENERIC_SCENARIO) { + generate_generic_scenario(g_test_dir, g_pdml_in_origin); + } + /*if (actions & GENERATE_DEDICATED_SCENARIO) { + generate_dedicated_scenario(g_test_dir, g_pdml_in_origin); + }*/ + return 0; } diff --git a/openair3/TEST/EPC_TEST/generic_scenario.xsl b/openair3/TEST/EPC_TEST/generic_scenario.xsl new file mode 100644 index 0000000000..99672a28f0 --- /dev/null +++ b/openair3/TEST/EPC_TEST/generic_scenario.xsl @@ -0,0 +1,46 @@ +<xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns="http://www.w3.org/TR/xhtml1/strict"> + +<xsl:output + method="xml" + indent="yes" + encoding="iso-8859-1" +/> + +<xsl:strip-space elements="proto field"/> + +<scenario name="{$test_name}"> + +<xsl:template match="proto[@name='frame']"> + <DEBUG_FRAME> + <xsl:variable name="time_relative" select="field[@name='frame.time_relative']/@show"/> + <xsl:variable name="ip" select="proto[@name='ip']"/> + <xsl:variable name="ip.src" select="$ip/field[@name='ip.src']/@show"/> + <xsl:variable name="ip.dst" select="$ip/field[@name='ip.dst']/@show"/> + + <xsl:for-each select="$ip/proto[@name='sctp']"> + <xsl:variable name="sctp.data_sid" select="./field[@name='sctp.data_sid']/@show"/> + <xsl:variable name="sctp.srcport" select="./field[@name='sctp.srcport']/@show"/> + <xsl:variable name="sctp.dstport" select="./field[@name='sctp.dstport']/@show"/> + <xsl:variable name="sctp.data_ssn" select="./field[@name='sctp.data_ssn']/@show"/> + <xsl:variable name="sctp.data_payload_proto_id" select="./field[@name='sctp.data_payload_proto_id']/@show"/> + + <xsl:for-each select="./proto[@name='s1ap']"> + <payload name="{ip_dst}"> + <frame.time_relative value="{$time_relative}"/> + <ip.dst value="{$ip.dst}"/> + <ip.src value="{$ip.src}"/> + <sctp.data_sid value="{$sctp.data_sid}"/> + <sctp.srcport value="{$sctp.srcport}"/> + <sctp.dstport value="{$sctp.dstport}"/> + <sctp.data_ssn value="{$sctp.data_ssn}"/> + <sctp.data_payload_proto_id value="{$sctp.data_payload_proto_id}"/> + <xsl:copy-of select="node()"/> + </payload> + </xsl:for-each> + </xsl:for-each> + </DEBUG_FRAME> +</xsl:template> +</scenario> +</xsl:stylesheet> diff --git a/openair3/TEST/EPC_TEST/mme_test_s1_pcap2pdml b/openair3/TEST/EPC_TEST/mme_test_s1_pcap2pdml index b0a77e60f5..796fa9a45b 100755 --- a/openair3/TEST/EPC_TEST/mme_test_s1_pcap2pdml +++ b/openair3/TEST/EPC_TEST/mme_test_s1_pcap2pdml @@ -35,14 +35,25 @@ packets = orig_dom.getElementsByTagName("packet") for packet in packets: found_sctp = False found_s1ap = False + sctp_node = None + frame_node = None + ip_node = None protos = packet.getElementsByTagName("proto") for proto in protos: attrs = proto.attributes urlnode = attrs['name'] - if urlnode.nodeValue == 'sctp': + if urlnode.nodeValue == 'frame': + frame_node = proto + elif urlnode.nodeValue == 'ip': + frame_node.appendChild(proto) + ip_node = proto + elif urlnode.nodeValue == 'sctp': found_sctp = True + ip_node.appendChild(proto) + sctp_node = proto elif urlnode.nodeValue == 's1ap': found_s1ap = True + sctp_node.appendChild(proto) elif urlnode.nodeValue == 'geninfo': packet.removeChild(proto) elif urlnode.nodeValue == 'eth': @@ -54,20 +65,21 @@ for packet in packets: ##################### # dom to xml string ##################### -filtered_pdml_string = orig_dom.toxml() +filtered_pdml_string = orig_dom.toprettyxml(indent=" ") cleaned_pdml_string = "" ##################### # remove blank lines in xml string ##################### lines = filtered_pdml_string.splitlines() for line in lines: - if line[:-1]: - cleaned_pdml_string += line + '\r\n' + if len(line.strip()): + if line[:-1]: + cleaned_pdml_string += line + '\r\n' #print "'%s'" % cleaned_pdml_string ##################### # write pdml string to pdml file ##################### -out_pdml_file_name = os.path.dirname(orig_pcap_file_name) + os.path.splitext(os.path.basename(orig_pcap_file_name))[0] + '.pdml' +out_pdml_file_name = os.path.dirname(orig_pcap_file_name) + '/' + os.path.splitext(os.path.basename(orig_pcap_file_name))[0] + '.pdml' out_file = open(out_pdml_file_name, "w") out_file.write(cleaned_pdml_string) out_file.close() @@ -86,7 +98,7 @@ filtered_html_string = etree.tostring(trans_root) ##################### # write html string to html file ##################### -out_html_file_name = os.path.dirname(orig_pcap_file_name) + os.path.splitext(os.path.basename(orig_pcap_file_name))[0] + '.html' +out_html_file_name = os.path.dirname(orig_pcap_file_name) + '/' +os.path.splitext(os.path.basename(orig_pcap_file_name))[0] + '.html' out_file = open(out_html_file_name, "w") out_file.write(filtered_html_string) out_file.close() -- 2.26.2