[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2016-05-07 15:44 GMT+02:00 Pascal Quantin <pascal.quantin@xxxxxxxxx>:

Hi Reginaldo,

2016-05-07 1:19 GMT+02:00 reginaldo salles <reginaldosalles1972@xxxxxxxxx>:

I can not see the contents of the SMS capture in plaintext.
Traffic does not have encryption and still can not see the content of the SMS. Wireshark bug? Anybody know how to figure out this problem?

wireshark .cap file: https://www.cloudshark.org/captures/504bc91928e3

wcpdump .cap file:  https://www.cloudshark.org/captures/9ec3f39d2c03

The LAPDm reassembly code gets confused by your capture:

-  the ICMP error packets are included in the reassembly table while they should not be

- the LAPDm retransmissions (with the polling bit set) are also wrongly included in the reassembly table

I'm gonna fix those bugs but in the meantime you can manually exclude those packets to get a proper dissection.
In the SMS_TCPDUMP.cap file, keep packets 1, 5, 6, 8, 9, 11, 15, 16, 18 and 19.

The patch is available here: https://code.wireshark.org/review/#/c/15281

But I'm a bit surprised with the way the N(S) counter gets incremented. Did you filter some LAPDm packets (like SABM frames)? Typically frames 15 and 19 have the same uplink direction and the same N(S) value while the content is different.

Regards,

Pascal.