wireshart shows wrong information
Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
i m sorry i accidentally press the wrong combination of keys and the mail left .... resuming my message below ..... this is the data that tcpdump show as being transmitted for this attribute: type = 1a length = 1a vendor = 00 00 15 9f vendor-type = 5a vendor-length = 14 subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 subtype = 02 (3GPP2-Prepaid-Acct-Quota-VolumeQuota)subtype-length=06value = 00 00 00 00 subtype = 04 (3GPP2-Prepaid-Acct-Quota-VolumeThreshold)length = 06 value = 00 00 88 fa i dont see where i m doing wrong ... any help will be appreciated. From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: wireshart shows wrong information Date: Thu, 25 Apr 2013 20:53:58 +0000 Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
thank you very much for your reply, please find attached the pcap file. the access-accept are "my" packages .. those are the ones with the problem. thanks! From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: wireshart shows wrong information Date: Thu, 25 Apr 2013 21:00:51 +0000 i m sorry i accidentally press the wrong combination of keys and the mail left .... resuming my message below ..... this is the data that tcpdump show as being transmitted for this attribute: type = 1a length = 1a vendor = 00 00 15 9f vendor-type = 5a vendor-length = 14 subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 subtype = 02 (3GPP2-Prepaid-Acct-Quota-VolumeQuota)subtype-length=06value = 00 00 00 00 subtype = 04 (3GPP2-Prepaid-Acct-Quota-VolumeThreshold)length = 06 value = 00 00 88 fa i dont see where i m doing wrong ... any help will be appreciated. From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: wireshart shows wrong information Date: Thu, 25 Apr 2013 20:53:58 +0000 Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
i realise now that i may have not been very clear in my explanation of the problem, that problem is that all values for the fields are the wrong values, for example, this is my code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ)); and this is what travels on the wire: subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 and this happens for all values ... i might be missing something .... thanks! From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: wireshart shows wrong information Date: Thu, 25 Apr 2013 21:00:51 +0000 i m sorry i accidentally press the wrong combination of keys and the mail left .... resuming my message below ..... this is the data that tcpdump show as being transmitted for this attribute: type = 1a length = 1a vendor = 00 00 15 9f vendor-type = 5a vendor-length = 14 subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 subtype = 02 (3GPP2-Prepaid-Acct-Quota-VolumeQuota)subtype-length=06value = 00 00 00 00 subtype = 04 (3GPP2-Prepaid-Acct-Quota-VolumeThreshold)length = 06 value = 00 00 88 fa i dont see where i m doing wrong ... any help will be appreciated. From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: wireshart shows wrong information Date: Thu, 25 Apr 2013 20:53:58 +0000 Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
Juan Pablo L. wrote:
i realise now that i may have not been very clear in my explanation of the problem, that problem is that all values for the fields are the wrong values, for example, this is my code:
pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));
and this is what travels on the wire:
subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier) subtype-length = 06 value = f3 08 48 12
I don't see that in the wireshark output. The value in the pcap file is correct. Alan DeKok.
Alan, can you please extend a little bot more ... what do you mean that you see the correct value .... i see value "f3 08 48 12" when i m actually expecting "00000001" ..... i really dont see where it is actually correct. ... thanks!!! From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: wireshart shows wrong information Date: Fri, 26 Apr 2013 14:22:20 +0000 i realise now that i may have not been very clear in my explanation of the problem, that problem is that all values for the fields are the wrong values, for example, this is my code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ)); and this is what travels on the wire: subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 and this happens for all values ... i might be missing something .... thanks! From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: wireshart shows wrong information Date: Thu, 25 Apr 2013 21:00:51 +0000 i m sorry i accidentally press the wrong combination of keys and the mail left .... resuming my message below ..... this is the data that tcpdump show as being transmitted for this attribute: type = 1a length = 1a vendor = 00 00 15 9f vendor-type = 5a vendor-length = 14 subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 subtype = 02 (3GPP2-Prepaid-Acct-Quota-VolumeQuota)subtype-length=06value = 00 00 00 00 subtype = 04 (3GPP2-Prepaid-Acct-Quota-VolumeThreshold)length = 06 value = 00 00 88 fa i dont see where i m doing wrong ... any help will be appreciated. From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: wireshart shows wrong information Date: Thu, 25 Apr 2013 20:53:58 +0000 Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
Juan Pablo L. wrote:
Alan, can you please extend a little bot more ... what do you mean that you see the correct value .... i see value "f3 08 48 12" when i m actually expecting "00000001" ..... i really dont see where it is actually correct. ... thanks!!!
In the debug log *I* see, it has the correct value. In the pcap file *I* see, it has the correct value. You're still not being specific. You see a bad value. OK... where? In what file? In what packet of what file? Which version of FreeRADIUS are you using? You keep waving your hands and saying "something is wrong". I keep asking you for details, and you keep saying "something is wrong". You don't understand that those details are *important*. You seem to believe that if you repeat yourself long enough, I'll understand. Well, I won't. I'm asking for those details because I need those details. When you refuse (repeatedly) to provide those details, it makes me likely to start ignoring your messages. If you can't be bothered to describe what's happening, I can't be bothered to help you. Alan DeKok.
On Mon, Apr 29, 2013 at 12:14 AM, Alan DeKok <aland@deployingradius.com> wrote:
Juan Pablo L. wrote:
Alan, can you please extend a little bot more ... what do you mean that you see the correct value .... i see value "f3 08 48 12" when i m actually expecting "00000001" ..... i really dont see where it is actually correct. ... thanks!!!
In the debug log *I* see, it has the correct value.
In the pcap file *I* see, it has the correct value.
You're still not being specific. You see a bad value. OK... where? In what file? In what packet of what file? Which version of FreeRADIUS are you using?
You keep waving your hands and saying "something is wrong". I keep asking you for details, and you keep saying "something is wrong". You don't understand that those details are *important*. You seem to believe that if you repeat yourself long enough, I'll understand.
Well, I won't. I'm asking for those details because I need those details. When you refuse (repeatedly) to provide those details, it makes me likely to start ignoring your messages.
If you can't be bothered to describe what's happening, I can't be bothered to help you.
I assume that the OP has updated the radius dictionary file in Wireshark if any changes were made to the FreeRadius dictionary? It's under the "radius" directory under the main install of Wireshark that needs to have the exact same changes you made (if you made any changes to your FreeRadius dictionary files) to be made in Wireshark. Plus it may depend on the version of Wireshark you're running, if it's old it is sure to be out of date. That would determine if Wireshark correctly decodes the values or not.
Hi Alan, i m sorry i m sorry if i m not being clear enough, but please consider the example from my last reply: this is the code in the module:pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ)); and this is what travels on the wire: subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 as you see, the value in value is expected it to be 00000001 and not f3 08 48 12 . maybe is a misunderstanding from me. i m using freeradius stable 2.2 and wireshark 1.8.6. thanks! From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: wireshart shows wrong information Date: Fri, 26 Apr 2013 14:22:20 +0000 i realise now that i may have not been very clear in my explanation of the problem, that problem is that all values for the fields are the wrong values, for example, this is my code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ)); and this is what travels on the wire: subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 and this happens for all values ... i might be missing something .... thanks! From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: wireshart shows wrong information Date: Thu, 25 Apr 2013 21:00:51 +0000 i m sorry i accidentally press the wrong combination of keys and the mail left .... resuming my message below ..... this is the data that tcpdump show as being transmitted for this attribute: type = 1a length = 1a vendor = 00 00 15 9f vendor-type = 5a vendor-length = 14 subtype = 01 (3GPP2-Prepaid-Acct-Quota-QuotaIDentifier)subtype-length = 06 value = f3 08 48 12 subtype = 02 (3GPP2-Prepaid-Acct-Quota-VolumeQuota)subtype-length=06value = 00 00 00 00 subtype = 04 (3GPP2-Prepaid-Acct-Quota-VolumeThreshold)length = 06 value = 00 00 88 fa i dont see where i m doing wrong ... any help will be appreciated. From: jpablolorenzetti@hotmail.com To: freeradius-users@lists.freeradius.org Subject: wireshart shows wrong information Date: Thu, 25 Apr 2013 20:53:58 +0000 Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
Juan Pablo L. wrote:
Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ...
Can you post that information, or is it secret?
here is my dictionary entry:
That seems like it should work.
and for that i m writing the following code:
pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ)); pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ)); pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
That should work, too. Alan DeKok.
On 25 Apr 2013, at 16:53, "Juan Pablo L." <jpablolorenzetti@hotmail.com> wrote:
Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry:
ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlv BEGIN-TLV 3GPP2-Prepaid-Acct-Quota ATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integer ATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integer ATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integer END-TLV 3GPP2-Prepaid-Acct-Quota
and for that i m writing the following code:
pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ)); pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ)); pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));
How do you even hit 't' from there... Want to provide that pcap file? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
participants (5)
-
A.L.M.Buxey@lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Juan Pablo L. -
Peter Lambrechtsen