Proactive commands with a body over 127 bytes (e.g. SET UP MENU with a
long item list) use a long-form length (0x81 NN / 0x82 NN NN) in their
D0 wrapper. Previously parse_tlv bailed on those, so the FETCH decoded
as a bare 'FETCH' without its command name or items.
Tests: 105 (long-form 1/2-byte, real SET UP MENU sample).
- pcap.py: parse_pcap (micro/nano, both byte orders) and parse_pcapng
(SHB byte-order, IDB linktype + if_tsresol, EPB/SPB) readers that
unwrap Ethernet/RAW/IPv4/NULL/SLL/SLL2 to UDP and extract GSMTAP-SIM
packets (APDU->tpdu, ATR->atr, PPS->pps), with a heuristic fallback
- database: insert_messages bulk-insert helper
- server: import endpoint reads raw body, auto-detects format, skips
non-GSMTAP packets; 400 'No GSMTAP data found in trace' (no session)
when empty, else creates a 'pcap' session named after the file
Tests: 102 (pcap round-trip, pcapng, no-GSMTAP, endpoint 200/400).
pcap.py: LINKTYPE_GSMTAP (155) was wrong — 155 is DLT_USER8, so
Wireshark showed 'USER 8 / DLT=155'. Now write Ethernet-encapsulated
PCAP (LINKTYPE 1): each GSMTAP message wrapped in Ethernet + IPv4 +
UDP (port 4729), with correct checksums — matching a real tcpdump
capture of GSMTAP-over-UDP and how Wireshark's gsmtap dissector is keyed.
gsmtap.py: GSMTAP_TYPE_SIM was 0x07 (WiMAX burst) — corrected to 0x04;
GSMTAP_SIM_APDU was 0x02 (PPS req) — corrected to 0x00; added PPS_REQ/
PPS_RSP. These match libosmocore/Wireshark packet-gsmtap.h.
Verified with tshark: PCAP now decodes as GSM SIM (SELECT/STATUS/ATR)
instead of 'USER 8'.
tests: pcap tests assert Ethernet linktype + framing + GSMTAP payload.
pcap.py: build_pcap(packets) — build PCAP bytes in memory (same format
as PcapWriter)
database.py: get_messages_raw() — raw elapsed/type/data without decode
server.py: GET /api/sessions/<id>/pcap generates a GSMTAP-encapsulated
PCAP (ATR/TPDU) with real timestamps and downloads it as
<session-name>.pcap (ASCII filename fallback + RFC 5987 UTF-8 for
spaces/unicode via _content_disposition)
tests: build_pcap + _content_disposition (67 total)
- PLI_QUALIFIERS: TS 102 223 qualifier values (Location Info, IMEI,
NMR, Date/time, Timing Advance, Access Technology, etc.)
- _command_details_name(): appends the qualifier description to
PROVIDE LOCAL INFORMATION (type 0x26) in Command Details
- decode_cat (FETCH) and decode_tr_command (TR) now use it, so both
'cat_command' and 'response_to' carry the qualifier (e.g.
'PROVIDE LOCAL INFORMATION — IMEI')
tests: PLI qualifier cases (TR/FETCH, IMEI/location/date, non-PLI)
decode.py:
- _decode_fcp: FCP/FCI/FMD template — full bit-level file descriptor
(TS 102 221 Table 11.5: file type, structure, shareable, data coding,
record length, num records), file ID (+ KNOWN_FIDS name), DF name,
SFI, life cycle
- _decode_auth: GSM SRES+Kc, or 3G tag DB (RES/CK/IK/KC) / DC (AUTS)
- _decode_tr_result: TERMINAL RESPONSE Result TLV (code + name)
- _decode_response_for(ins, data): GET RESPONSE decodes its body using
the previous command's INS (SELECT→FCP, AUTHENTICATE→auth)
- decode_message wires response decoding for TR and GET RESPONSE
database.py: prev context now carries 'ins' (INS byte) via
_context_from_decoded, used by GET RESPONSE response decoding
tests: FCP, AUTH (GSM/3G), TR result, GET RESPONSE wiring (57 total)
decode.py: split decode_tr_command() out of decode_cat(); TR (0x14)
now stores the echoed proactive command type in 'response_to' instead
of 'cat_command', so it no longer overrides the INS name.
FETCH/ENVELOPE still use cat_command as the primary label.
tests: TR now asserts response_to + no cat_command
decode.py:
- decode_cat: TERMINAL RESPONSE (0x14) now extracts the proactive
command type from its echoed Command Details (tag 81) — no history
lookup needed since TR carries its own type
- decode_message gains prev param; GET RESPONSE (0xC0) resolves
'response_for' from the previous command when its SW1 was 0x61,
else None (orphaned)
- decode_sniff_msg threads prev through
database.py:
- _row_to_message accepts prev; new _decode_rows tracks previous-TPDU
context in sequence; get_messages/get_messages_after seed context
from the message before the window/cursor
tests: TR cat_command + GET RESPONSE context/orphaned cases (49 total)
catarrh