Version 1 - History - Trace access rights sinus501 fritzbox7240 - OsmocomDECT - Open Source Mobile Communications

1

laforge

h1. Access rights request between Sinus 501 and FRITZ!Box 7240

2

3

{{>toc}}

4

5

The entire trace contains the initial access rights request and key allocation, location registration of the PP including temporary

6

identity assignment, a test call from the FP and exchange of some proprietary configuration options in CISS-FACILITY messages.

7

8

For better readability, the independent procedures have been seperated in the trace. The raw dump is attached to this page.

9

10

h2. Access rights request

11

12

h3. {ACCESS-RIGHTS-REQUEST} message (PP->FP)

13

14

<pre>

15

NWK: 05 44 05 07 80 a8 00 ba 8a 78 2a 0a 03 01 48 00     |.D.......x*...H.|

16

NWK: 63 0f 25 15 0a 00 30 03 90 02 00 00 00 00 00 82     |c.%...0.........|

17

NWK: 82 7b 13 81 00 02 06 01 10 29 0b 6f 7d fe 7f 00     |.{.......).o}...|

18

NWK: ff 9c 80 2b c2 14 7c 07 90 03 00 01 02 00 84        |...+..|........|

19

{MM-ACCESS-RIGHTS-REQUEST} message:

20

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfcf150

21

        type: IPUI (0)

22

        PUT: N (IPEI)

23

        EMC: 0ba8

24

        PSN: a782a

25

  IE: <<AUTH-TYPE>> id: a len: 5 dst: 0xfcf190

26

        authentication algorithm: DSAA (1)

27

        authentication key type: Authentication code (4)

28

        authentication key number: 8

29

        cipher key number: 0

30

        INC: 0 DEF: 0 TXC: 0 UPC: 0

31

  IE: <<TERMINAL-CAPABILITY>> id: 63 len: 17 dst: 0xfcf1b0

32

        display capability: full display (5)

33

        tone capability: dial tone only (2)

34

        echo parameters: TCL > 34 dB (1)

35

        noise rejection capability: none (1)

36

        adaptive volume control provision: no PP adaptive volume control (1)

37

        slot capabilities: long slot 640,full slot (a)

38

        display memory: 48

39

        display lines: 3

40

        display columns: 16

41

        scrolling behaviour: not specified (0)

42

        profile indicator: GAP,DECT-NG part 1 (200000000000200)

43

        display control: 2

44

        display charsets: 0

45

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 21 dst: 0xfcf200

46

        EMC: 2

47

        Content: 06 01 10 29 0b 6f 7d fe 7f 00 ff 9c 80 2b c2 14

48

  IE: <<CODEC-LIST>> id: 7c len: 9 dst: 0xfcf260

49

        Negotiation Indicator: codec negotiation (1)

50

        Codec 1:

51

         Codec: G.722 (64kbit) (3)

52

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

53

         Slot size: long slot j=640 (1)

54

         C-Plane routing: C_S only (0)

55

        Codec 2:

56

         Codec: G.726 (32kbit) (2)

57

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

58

         Slot size: full slot (4)

59

         C-Plane routing: C_S only (0)

60

</pre>

61

62

h3. {KEY-ALLOCATE} message (FP->PP)

63

64

<pre>

65

NWK: 05 42 0b 02 01 88 0c 08 1b 42 27 01 4c 5c 44 84     |.B.......B'.L\D.|

66

NWK: 0e 08 9e 01 7e 0c 42 ae ec ff                       |....~.B...|

67

{MM-KEY-ALLOCATE} message:

68

  IE: <<ALLOCATION-TYPE>> id: b len: 4 dst: 0xfcf440

69

        authentication algorithm: DSAA (1)

70

        authentication key number: 8

71

        authentication code number: 8

72

  IE: <<RAND>> id: c len: 10 dst: 0xfcf460

73

        value: 84445c4c0127421b

74

  IE: <<RS>> id: e len: 10 dst: 0xfcf480

75

        value: ffecae420c7e019e

76

</pre>

77

78

h3. {AUTHENTICATION-REQUEST} message (PP->FP)

79

80

<pre>

81

NWK: 85 40 0a 03 01 48 00 0c 08 de a7 66 4d 34 fb c2     |.@...H.....fM4..|

82

NWK: 7f 0d 04 85 6a 5f 9e                                |....j_.|

83

{MM-AUTHENTICATION-REQUEST} message:

84

  IE: <<AUTH-TYPE>> id: a len: 5 dst: 0xfcf5e0

85

        authentication algorithm: DSAA (1)

86

        authentication key type: Authentication code (4)

87

        authentication key number: 8

88

        cipher key number: 0

89

        INC: 0 DEF: 0 TXC: 0 UPC: 0

90

  IE: <<RAND>> id: c len: 10 dst: 0xfcf600

91

        value: 7fc2fb344d66a7de

92

  IE: <<RES>> id: d len: 6 dst: 0xfcf620

93

        value: 9e5f6a85

94

</pre>

95

96

h3. {AUTHENTICATION-REPLY} message (FP->PP)

97

98

<pre>

99

NWK: 05 41 0d 04 b4 30 43 48                             |.A...0CH|

100

{MM-AUTHENTICATION-REPLY} message:

101

  IE: <<RES>> id: d len: 6 dst: 0xfcf780

102

        value: 484330b4

103

</pre>

104

105

h3. {ACCESS-RIGHTS-ACCEPT} message (FP->PP)

106

107

<pre>

108

NWK: 85 45 05 07 80 a8 00 ba 8a 78 2a 06 07 a0 a5 01     |.E.......x*.....|

109

NWK: 2f 55 f4 f8 7c 07 90 03 00 01 02 00 84              |/U..|........|

110

{MM-ACCESS-RIGHTS-ACCEPT} message:

111

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfcf8e0

112

        type: IPUI (0)

113

        PUT: N (IPEI)

114

        EMC: 0ba8

115

        PSN: a782a

116

  IE: <<FIXED-IDENTITY>> id: 6 len: 9 dst: 0xfcf920

117

        type: PARK (20)

118

        class: A

119

        EMC: 12f5

120

        FPN: 0be9f

121

  IE: <<CODEC-LIST>> id: 7c len: 9 dst: 0xfcf950

122

        Negotiation Indicator: codec negotiation (1)

123

        Codec 1:

124

         Codec: G.722 (64kbit) (3)

125

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

126

         Slot size: long slot j=640 (1)

127

         C-Plane routing: C_S only (0)

128

        Codec 2:

129

         Codec: G.726 (32kbit) (2)

130

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

131

         Slot size: full slot (4)

132

         C-Plane routing: C_S only (0)

133

</pre>

134

135

h2. Location registration

136

137

h3. {LOCATE-REQUEST} message (PP->FP)

138

139

<pre>

140

NWK: 05 54 05 07 80 a8 00 ba 8a 78 2a 06 07 81 a8 01     |.T.......x*.....|

141

NWK: 2f 55 f4 f8 07 01 64 63 0f 25 15 0a 00 30 03 90     |/U....dc.%...0..|

142

NWK: 02 00 00 00 00 00 82 82 7c 07 90 03 00 01 02 00     |........|.......|

143

NWK: 84                                                  |.|

144

{MM-LOCATE-REQUEST} message:

145

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfcfd20

146

        type: IPUI (0)

147

        PUT: N (IPEI)

148

        EMC: 0ba8

149

        PSN: a782a

150

  IE: <<FIXED-IDENTITY>> id: 6 len: 9 dst: 0xfcfd60

151

        type: ARI/RPN (1)

152

        class: A

153

        EMC: 12f5

154

        FPN: 0be9f

155

        RPN: 0

156

  IE: <<LOCATION-AREA>> id: 7 len: 3 dst: 0xfcfd90

157

        type: 1 level: 36

158

  IE: <<TERMINAL-CAPABILITY>> id: 63 len: 17 dst: 0xfcfdb0

159

        display capability: full display (5)

160

        tone capability: dial tone only (2)

161

        echo parameters: TCL > 34 dB (1)

162

        noise rejection capability: none (1)

163

        adaptive volume control provision: no PP adaptive volume control (1)

164

        slot capabilities: long slot 640,full slot (a)

165

        display memory: 48

166

        display lines: 3

167

        display columns: 16

168

        scrolling behaviour: not specified (0)

169

        profile indicator: GAP,DECT-NG part 1 (200000000000200)

170

        display control: 2

171

        display charsets: 0

172

  IE: <<CODEC-LIST>> id: 7c len: 9 dst: 0xfcfe00

173

        Negotiation Indicator: codec negotiation (1)

174

        Codec 1:

175

         Codec: G.722 (64kbit) (3)

176

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

177

         Slot size: long slot j=640 (1)

178

         C-Plane routing: C_S only (0)

179

        Codec 2:

180

         Codec: G.726 (32kbit) (2)

181

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

182

         Slot size: full slot (4)

183

         C-Plane routing: C_S only (0)

184

</pre>

185

186

h3. {AUTHENTICATION-REQUEST} message (FP->PP)

187

188

<pre>

189

NWK: 05 40 0a 03 01 18 18 0c 08 4e cc 38 f5 13 34 dd     |.@.......N.8..4.|

190

NWK: 23 0e 08 31 76 76 d3 12 15 97 20                    |#..1vv.... |

191

{MM-AUTHENTICATION-REQUEST} message:

192

  IE: <<AUTH-TYPE>> id: a len: 5 dst: 0xfd0500

193

        authentication algorithm: DSAA (1)

194

        authentication key type: User authentication key (1)

195

        authentication key number: 8

196

        cipher key number: 8

197

        INC: 0 DEF: 0 TXC: 0 UPC: 1

198

  IE: <<RAND>> id: c len: 10 dst: 0xfd0520

199

        value: 23dd3413f538cc4e

200

  IE: <<RS>> id: e len: 10 dst: 0xfd0540

201

        value: 20971512d3767631

202

</pre>

203

204

h3. {AUTHENTICATION-REPLY} message (PP->FP)

205

206

<pre>

207

NWK: 85 41 0d 04 88 9b 49 e0                             |.A....I.|

208

{MM-AUTHENTICATION-REPLY} message:

209

  IE: <<RES>> id: d len: 6 dst: 0xfd0980

210

        value: e0499b88

211

</pre>

212

213

h3. {LOCATE-ACCEPT} message (FP->PP)

214

215

<pre>

216

NWK: 85 55 05 05 a0 94 00 11 01 07 01 64 77 07 c0 81     |.U.........dw...|

217

NWK: 00 00 0c c0 00 7c 07 90 03 00 01 02 00 84           |.....|........|

218

{MM-LOCATE-ACCEPT} message:

219

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 7 dst: 0xfd0ec0

220

        type: TPUI (20)

221

        type: individual assigned

222

        digits: 00000

223

  IE: <<LOCATION-AREA>> id: 7 len: 3 dst: 0xfd0f00

224

        type: 1 level: 36

225

  IE: <<IWU-TO-IWU>> id: 77 len: 9 dst: 0xfd0f20

226

        Send/Reject (S/R) bit: Transmission of message (1)

227

        Protocol Discriminator: User Specific (0)

228

  IE: <<CODEC-LIST>> id: 7c len: 9 dst: 0xfd1040

229

        Negotiation Indicator: codec negotiation (1)

230

        Codec 1:

231

         Codec: G.722 (64kbit) (3)

232

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

233

         Slot size: long slot j=640 (1)

234

         C-Plane routing: C_S only (0)

235

        Codec 2:

236

         Codec: G.726 (32kbit) (2)

237

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

238

         Slot size: full slot (4)

239

         C-Plane routing: C_S only (0)

240

</pre>

241

242

h3. {TEMPORARY-IDENTITY-ASSIGN-ACK} message (PP->FP)

243

244

<pre>

245

NWK: 05 5d                                               |.]|

246

{MM-TEMPORARY-IDENTITY-ASSIGN-ACK} message:

247

</pre>

248

249

h2. Test call

250

251

h3. {CC-SETUP} message (FP->PP)

252

253

<pre>

254

NWK: 03 05 05 07 80 a8 00 ba 8a 78 2a 06 07 a0 a5 01     |.........x*.....|

255

NWK: 2f 55 f4 f8 e0 80 e4 4f 7c 04 90 02 00 84           |/U.....O|.....|

256

{CC-SETUP} message:

257

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfcfbd0

258

        type: IPUI (0)

259

        PUT: N (IPEI)

260

        EMC: 0ba8

261

        PSN: a782a

262

  IE: <<FIXED-IDENTITY>> id: 6 len: 9 dst: 0xfcfc10

263

        type: PARK (20)

264

        class: A

265

        EMC: 12f5

266

        FPN: 0be9f

267

  IE: <<BASIC-SERVICE>> id: e0 len: 2 dst: 0xfcfc40

268

        call class: normal call (8)

269

        service: basic speech default attributes (0)

270

  IE: <<SIGNAL>> id: e4 len: 2 dst: 0xfcfc60

271

        signal: ring off (4f)

272

  IE: <<CODEC-LIST>> id: 7c len: 6 dst: 0xfcfc80

273

        Negotiation Indicator: codec negotiation (1)

274

        Codec 1:

275

         Codec: G.726 (32kbit) (2)

276

         MAC/DLC Service: DLC service: LU1, MAC service: I_NA (0)

277

         Slot size: full slot (4)

278

         C-Plane routing: C_S only (0)

279

</pre>

280

281

h3. {CC-ALERTING} message (PP->FP)

282

<pre>

283

NWK: 83 01 7b 06 81 00 02 18 01 02                       |..{.......|

284

{CC-ALERTING} message:

285

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd0120

286

        EMC: 2

287

        Content: 18 01 02

288

</pre>

289

290

h3. {CC-INFO} message (FP->PP)

291

292

<pre>

293

NWK: 03 7b 7b 06 81 00 02 3c 01 07                       |.{{....<..|

294

{CC-INFO} message:

295

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd07e0

296

        EMC: 2

297

        Content: 3c 01 07

298

</pre>

299

300

h3. {CC-INFO} message (PP->FP)

301

302

<pre>

303

NWK: 83 7b 7b 06 81 00 02 3d 01 07                       |.{{....=..|

304

{CC-INFO} message:

305

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd0c20

306

        EMC: 2

307

        Content: 3d 01 07

308

</pre>

309

310

h3. {CC-INFO} message (FP->PP)

311

312

<pre>

313

NWK: 03 7b 7b 0b 81 00 02 1c 06 0c 10 0f 0b 01 0d        |.{{............|

314

{CC-INFO} message:

315

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 13 dst: 0xfd0c80

316

        EMC: 2

317

        Content: 1c 06 0c 10 0f 0b 01 0d

318

</pre>

319

320

h3. {CC-RELEASE} message (FP->PP)

321

322

<pre>

323

NWK: 03 4d e2 00                                         |.M..|

324

{CC-RELEASE} message:

325

  IE: <<RELEASE-REASON>> id: e2 len: 2 dst: 0xfd15a0

326

        release reason: normal (0)

327

</pre>

328

329

h3. {CC-RELEASE-COM} message (PP->FP)

330

331

<pre>

332

NWK: 83 5a e2 00                                         |.Z..|

333

{CC-RELEASE-COM} message:

334

  IE: <<RELEASE-REASON>> id: e2 len: 2 dst: 0xfd1b20

335

        release reason: normal (0)

336

</pre>

337

338

h2. CISS information exchange

339

340

The last proprietary IE (last 3 bytes) contains a sequence number that must be acknowledged. If no answer is sent back (not visible in this

341

trace), the message is resent.

342

343

The coding is:

344

345

<CISS-REQUEST-SEQ>: 0x5b[[BR]]

346

<CISS-ACKNOWLEDGEMENT-SEQ>: 0x59[[BR]]

347

348

h3. CISS information exchange 1

349

350

This exchange supplies the date (12.10.10) and time (23:45:01)

351

to the PP. For some reason the hex values contain the decimal

352

representation. The first byte (03) has unknown meaning, as do

353

the 2 bytes following the date (00 04).

354

355

<TIME-DATE>: 0x3b[[BR]]

356

357

h4. {CISS-FACILITY} message (FP->PP)

358

359

<pre>

360

{CISS-FACILITY} message:

361

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 19 dst: 0xfd0180

362

        EMC: 2

363

        Content: 3b 09 03 12 10 10 00 04 23 45 01 5b 01 a8

364

</pre>

365

366

h4. {CISS-REGISTER}/{CISS-RELEASE-COM} messages (PP->FP)

367

368

<pre>

369

NWK: 64 64 05 07 90 a8 00 ba 8a 78 2a 7b 06 81 00 02     |dd.......x*{....|

370

NWK: 59 01 a8                                            |Y..|

371

{CISS-REGISTER} message:

372

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfd0460

373

        type: IPEI (10)

374

        PUT: N (IPEI)

375

        EMC: 0ba8

376

        PSN: a782a

377

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd04a0

378

        EMC: 2

379

        Content: 59 01 a8

380

381

NWK: 64 5a                                               |dZ|

382

{CC-RELEASE-COM} message:

383

</pre>

384

385

h3. CISS information exchange 2

386

387

This exchange supplies the PP name (Mobiltei..) to the PP.

388

The meaning of the first byte (01) is unknown.

389

390

<PP-NAME>: 0x54[[BR]]

391

392

h4. {CISS-FACILITY} message (FP->PP)

393

394

<pre>

395

NWK: 63 62 7b 13 81 00 02 54 0b 01 4d 6f 62 69 6c 74     |cb{....T..Mobilt|

396

NWK: 65 69 2e 2e 5b 01 a9                                |ei..[..|

397

{CISS-FACILITY} message:

398

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 21 dst: 0xfd1360

399

        EMC: 2

400

        Content: 54 0b 01 4d 6f 62 69 6c 74 65 69 2e 2e 5b 01 a9

401

</pre>

402

403

h4. {CISS-REGISTER}/{CISS-RELEASE-COM} messages (PP->FP)

404

405

<pre>

406

NWK: 64 64 05 07 90 a8 00 ba 8a 78 2a 7b 06 81 00 02     |dd.......x*{....|

407

NWK: 59 01 a9                                            |Y..|

408

{CISS-REGISTER} message:

409

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfd15c0

410

        type: IPEI (10)

411

        PUT: N (IPEI)

412

        EMC: 0ba8

413

        PSN: a782a

414

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd1600

415

        EMC: 2

416

        Content: 59 01 a9

417

418

NWK: 64 5a                                               |dZ|

419

{CISS-RELEASE-COM} message:

420

</pre>

421

422

h3. CISS information exchange 3

423

424

h4. {CISS-FACILITY} message (FP->PP)

425

426

<pre>

427

NWK: 63 62 7b 12 81 00 02 58 0a 02 08 01 00 02 00 03     |cb{....X........|

428

NWK: 00 05 00 5b 01 aa                                   |...[..|

429

{CISS-FACILITY} message:

430

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 20 dst: 0xfd18e0

431

        EMC: 2

432

        Content: 58 0a 02 08 01 00 02 00 03 00 05 00 5b 01 aa

433

</pre>

434

435

h4. {CISS-REGISTER}/{CISS-RELEASE-COM} messages (PP->FP)

436

437

<pre>

438

NWK: 64 64 05 07 90 a8 00 ba 8a 78 2a 7b 06 81 00 02     |dd.......x*{....|

439

NWK: 59 01 aa                                            |Y..|

440

{CISS-REGISTER} message:

441

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfd1c80

442

        type: IPEI (10)

443

        PUT: N (IPEI)

444

        EMC: 0ba8

445

        PSN: a782a

446

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd1cc0

447

        EMC: 2

448

        Content: 59 01 aa

449

450

NWK: 64 5a                                               |dZ|

451

{CISS-RELEASE-COM} message:

452

</pre>

453

454

h3. CISS information exchange 4

455

456

This exchange supplies the time and date again, similar to 2.

457

458

h4. {CISS-FACILITY} message (FP->PP)

459

460

<pre>

461

NWK: 63 62 7b 11 81 00 02 3b 09 03 12 10 10 00 04 23     |cb{....;.......#|

462

NWK: 45 01 5b 01 ab                                      |E.[..|

463

{CISS-FACILITY} message:

464

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 19 dst: 0xfd1f00

465

        EMC: 2

466

        Content: 3b 09 03 12 10 10 00 04 23 45 01 5b 01 ab

467

</pre>

468

469

h4. {CISS-REGISTER}/{CISS-RELEASE-COM} messages (PP->FP)

470

471

<pre>

472

NWK: 64 64 05 07 90 a8 00 ba 8a 78 2a 7b 06 81 00 02     |dd.......x*{....|

473

NWK: 59 01 ab                                            |Y..|

474

{CISS-REGISTER} message:

475

  IE: <<PORTABLE-IDENTITY>> id: 5 len: 9 dst: 0xfd2140

476

        type: IPEI (10)

477

        PUT: N (IPEI)

478

        EMC: 0ba8

479

        PSN: a782a

480

  IE: <<ESCAPE-TO-PROPRIETARY>> id: 7b len: 8 dst: 0xfd2180

481

        EMC: 2

482

        Content: 59 01 ab

483

484

NWK: 64 5a                                               |dZ|

485

{CISS-RELEASE-COM} message:

486

</pre>

Project

General

Profile

OsmocomDECT

Trace access rights sinus501 fritzbox7240 » History » Version 1