Generic selectors
Exact matches only
Search in title
Search in content
Search in posts
Search in pages

LTE TAU IMSI STRUCTURE

  • This topic has 6 replies, 1 voice, and was last updated 3 years ago by pix.
Viewing 7 posts - 1 through 7 (of 7 total)
  • Author
    Posts
  • #70023 Reply
    paraHO
    Guest

    Analysing in an LTE network we found many TAU requests from UE that reports a very strange Old GUTI / EPS Identity with raw hex value 0b29071855102132713a8589
    – Length is 11 octets (!!!)
    – Type is 1 (IMSI)
    – Content is something like 270815501122317A35898 (invalid, should be up to 15 BCD digits)
    Any idea what this could be and how to prevent it from pummelling the radio network? This happens every 250ms for hours.

    #70024 Reply
    pix
    Guest

    hi paraHO 🙂

    that’s very strange indeed !

    does it happen on one specific cell ?

    i’ll look it up in my network, see if something similar is happening.

    cheers
    pix

    #70025 Reply
    paraHO
    Guest

    Hi Pix

    Yes happening in one cell and only one UE involved.

    Checked the CAP file, NAS-PDU, etc.

    Some interesting stuff. The EUTRAN-CGI shows correct MCC but MNC is Inactive. The EPS mobile identity – Old GUTI containing IMSI decodes to MCC in Europe and MNC in Indian? There is No TMSI identified. This UE is attempting combined TAU + IMSI Attach, yet not EMM connected?

    Not sure reason 250ms

    BR
    paraHO

    #70026 Reply
    pix
    Guest

    hi paraHO,

    Sorry, I totally forgot about that. Thanks for the additional details.

    #70027 Reply
    pix
    Guest

    hi paraHO,

    no weird TAU in France… i would suspect the decoding tool on your side in not correct ?

    That seems like the most realistic explanation 🙂

    cheers
    pix

    #70028 Reply
    paraHO
    Guest

    Hi pix thanks to checking. The PLMN ID 3-1-1-2-2-0 we find caused to get embedded in qualcomm the us operator spec for certain LTE UEs to accept list from network that runs in band5-850MHz.

    Looking in to strange IMSI – we not know answer yet.

    cheers

    paraHO

    #70029 Reply
    pix
    Guest

    hi paraHO,

    So you have 2 issues, right ?

    1/ the weird IMSI, that we don’t see in France (all IMSI are 15 digit, and use correct country codes)

    2/ ??? related to weird PLMN ID, which is caused by Qualcomm specific implementation for US operators? This PLMN id are found in the EPS mobile id/oldGuti of the weird IMSI, yes? And nowhere else?

    Don’t you think that due to the misformat of PLMN ID, the whole hexa message is offset and misdecoded by your trace tool ?

Viewing 7 posts - 1 through 7 (of 7 total)
Reply To: LTE TAU IMSI STRUCTURE
Your information:




<a href="" title="" rel="" target=""> <blockquote cite=""> <code> <pre class=""> <em> <strong> <del datetime="" cite=""> <ins datetime="" cite=""> <ul> <ol start=""> <li> <img src="" border="" alt="" height="" width="">