Skip to content

Conversation

@stigbjorlykke
Copy link
Contributor

Add a link-layer header type for the DECT New Radio protocol defined in ETSI TS 103 636-4.

@guyharris
Copy link
Member

So the current version of that is 1.4.1, although "An update is in preparation."

So is the packet content in a pcap or pcapng file a MAC PDU as specified in section 6.3, beginning with a MAC header type field, and ending with the MIC?

@stigbjorlykke
Copy link
Contributor Author

The pcap/pcapng packet will start with the "Physical Header Field" in section 6.2 and end with MIC only when MAC security is used.

6.2 Physical Header Field
6.3 MAC PDU
  6.3.2 MAC Header Type
  6.3.3 MAC Common Header
  -- One or more MAC SDUs included in MAC PDU with MAC multiplexing header
    6.3.4 MAC Multiplexing Header
    6.4 MAC Messages and IEs
  5.9.1 Message Integrity Code (MIC)

This is a snapshot from a Wireshark dissector in development:

DECT_NR_packet_example

@guyharris
Copy link
Member

The pcap/pcapng packet will start with the "Physical Header Field" in section 6.2

What indicates whether the physical layer header is Type 1 (40 bits/5 bytes) or Type 2 (80 bits/10 bytes)? Is the PHF Size field, as shown, a metadata field that precedes the Physical Header Field?

@stigbjorlykke
Copy link
Contributor Author

What indicates whether the physical layer header is Type 1 (40 bits/5 bytes) or Type 2 (80 bits/10 bytes)? Is the PHF Size field, as shown, a metadata field that precedes the Physical Header Field?

ETSI TS 103 636-3 chapter 7.5.1 "Overall description" states that

"The receiver shall blind decode both transport block sizes and select the one with a CRC match."

Unfortunately the CRC is not included at this level, and it's currently not possible to determine the size without adding a metadata field. We will ask the spec authors if it's possible to improve this in the format. I will mark this PR as draft until this is sorted out.

@stigbjorlykke stigbjorlykke marked this pull request as draft October 14, 2023 15:14
Add a link-layer header type for the DECT New Radio protocol
defined in ETSI TS 103 636-4.

The Physical Header Field is always encoded using 80 bits (10 bytes).
Broadcast transmissions using 40 bits (5 bytes) is padded with 40 zero
bits (5 bytes). When padding is used the Receiver Identity value 0x0000
(reserved address) is used to detect broadcast transmissions.
@stigbjorlykke
Copy link
Contributor Author

I have updated the documentation to describe how to handle the two different "Physical Header Field" sizes.

@stigbjorlykke stigbjorlykke marked this pull request as ready for review November 7, 2023 12:51
@guyharris guyharris merged commit e3c7139 into the-tcpdump-group:master Dec 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants