- This topic has 6 replies, 1 voice, and was last updated 3 years, 3 months ago by pix.
8th June 2017 at 18:24 #70023paraHOGuest
Analysing in an LTE network we found many TAU requests from UE that reports a very strange Old GUTI / EPS Identity with raw hex value 0b29071855102132713a8589
– Length is 11 octets (!!!)
– Type is 1 (IMSI)
– Content is something like 270815501122317A35898 (invalid, should be up to 15 BCD digits)
Any idea what this could be and how to prevent it from pummelling the radio network? This happens every 250ms for hours.17th June 2017 at 20:22 #70024pixGuest
hi paraHO 🙂
that’s very strange indeed !
does it happen on one specific cell ?
i’ll look it up in my network, see if something similar is happening.
pix22nd June 2017 at 10:22 #70025paraHOGuest
Yes happening in one cell and only one UE involved.
Checked the CAP file, NAS-PDU, etc.
Some interesting stuff. The EUTRAN-CGI shows correct MCC but MNC is Inactive. The EPS mobile identity – Old GUTI containing IMSI decodes to MCC in Europe and MNC in Indian? There is No TMSI identified. This UE is attempting combined TAU + IMSI Attach, yet not EMM connected?
Not sure reason 250ms
paraHO24th June 2017 at 08:46 #70026pixGuest
Sorry, I totally forgot about that. Thanks for the additional details.27th June 2017 at 14:17 #70027pixGuest
no weird TAU in France… i would suspect the decoding tool on your side in not correct ?
That seems like the most realistic explanation 🙂
pix28th June 2017 at 04:15 #70028paraHOGuest
Hi pix thanks to checking. The PLMN ID 3-1-1-2-2-0 we find caused to get embedded in qualcomm the us operator spec for certain LTE UEs to accept list from network that runs in band5-850MHz.
Looking in to strange IMSI – we not know answer yet.
paraHO29th June 2017 at 07:23 #70029pixGuest
So you have 2 issues, right ?
1/ the weird IMSI, that we don’t see in France (all IMSI are 15 digit, and use correct country codes)
2/ ??? related to weird PLMN ID, which is caused by Qualcomm specific implementation for US operators? This PLMN id are found in the EPS mobile id/oldGuti of the weird IMSI, yes? And nowhere else?
Don’t you think that due to the misformat of PLMN ID, the whole hexa message is offset and misdecoded by your trace tool ?