montimage / 5greplay Goto Github PK
View Code? Open in Web Editor NEWTool for modifying and replaying 5G protocol network traffic
Home Page: https://5greplay.org
License: Apache License 2.0
Tool for modifying and replaying 5G protocol network traffic
Home Page: https://5greplay.org
License: Apache License 2.0
Hi!
Is there any support for the O-FH C/U plane in 5Greplay?
We plan to use 5Greplay on these protocols, do you have any suggestions for us?
Hello,
I want to study the behavior of the 5g network when some messages are replayed and re-injected in the network. The network is based on srsRAN for enb and open5gs for the core network. I tested my configurations on a real UE and a simulated one, however with the same issue.
Please find attached the conf files and log from 5greplay and the pcap file I want to re-inject.
Your help is highly appreciated.
Running the command ./5greplay info [path_to_rule] shows type as DROP when type_property is set to FORWARD.
Event_count shows 2 with one event in rule.
Rule:
<beginning>
<embedded_functions><![CDATA[
]]></embedded_functions>
<property property_id="1" delay_units="ms" delay_min="0" delay_max="0"
type_property="FORWARD" description="Packet sent by open5gs Access and Mobility Management Function (AMF).">
<event event_id="1" value="COMPUTE"
description="Sent by AMF."
boolean_expression="( ( sctp.src_port == 38412 ) && ( #is_same_ipv4(ip.src, '127.0.0.5' ) ) )"/>
</property>
</beginning>
Info Output:
mmt-5greplay: 5Greplay v0.0.3-15ede75 using DPI v1.7.0.0 (a8ad3c2) is running on pid 4331
Found 1 rule.
1 - Rule id: 1
- type : DROP
- events_count : 2
- variables_count : 2
- variables : ip.src (178.13), sctp.src_port (304.1)
- description : Packet sent by open5gs Access and Mobility Management Function (AMF).
- if_satisfied : 0x7f8916358ae0
- version : 0.0.3 (15ede75 - 2022-1-30 18:6:45), dpi version 1.7.0.0 (a8ad3c2)
Hello, I am using following rule for offline packet modification.
root@9d2e77b65823:/opt/mmt/5greplay/rules# more registration_req_modified.xml
<beginning>
<property value="COMPUTE" property_id="94" type_property="FORWARD"
description="seding only malformed registration request messages" if_satisfied="#update(nas_5g.message_type, 0 )" >
<event description="Message type: Registration request (0x41)"
boolean_expression="( (nas_5g.message_type == 65) )"/>
</property>
</beginning>
the .so rule is compiled and used by the 5greplay.
root@9d2e77b65823:/opt/mmt/5greplay# ./5greplay info
mmt-5greplay: 5Greplay v0.0.3-f1300c5 using DPI v1.7.0.0 (a8ad3c2) is running on pid 1320
Found 1 rule.
1 - Rule id: 94
- type : DROP
- events_count : 2
- variables_count : 1
- variables : nas_5g.message_type (904.2)
- description : seding only malformed registration request messages
- if_satisfied : 0x7f499caffa00
- version : 0.0.3 (f1300c5 - 2022-10-10 8:54:54), dpi version 1.7.0.0 (a8ad3c2)
root@9d2e77b65823:/opt/mmt/5greplay#
It seems that the if_satisfied
does not happen. When using the following command to send modified packets, only the Registration request messages that exist in the pcap are replayed instead of malformed registration request messages.
Contents of the .conf file used and the respective command.
./5greplay replay -t pcap/test_proper.pcap -c 5greplay-sctp_korina.conf
root@9d2e77b65823:/opt/mmt/5greplay# more 5greplay-sctp_korina.conf
# option only when using DPDK to capture packets or to forwarding packets
dpdk-option = "--syslog=syslog --log-level=5 -c 0x55555555555"
#root stack of network protocol
# for Ethernet: 1
# for ieee802154: 800
# for Linux cooked capture: 624
stack-type = 1
input {
# in case for PCAP the input mode can be ONLINE or OFFLINE, however for DPDK it's only ONLINE
mode = ONLINE
# input source for PCAP online mode (interface name) and for offline mode (pcap name),
# however for DPDK its interface port number
# in DPDK mode, MMT supports also multi-port inputs,
# - e.g., source="0,1" will tell MMT to capture packets on port 0 and 1
# - MMT will aggregate traffic on these 2 ports, thus 2 packets of one flow can be received on 2 different ports
source = "pcap/test_proper.pcap"
# maximal size of a packet
snap-len = 65535 #
}
output {
enable = true
output-dir = "./" # Location where files are written:
sample-interval = 5 #a new sample file is created each x seconds given by output.cache-period
report-description = true # true to include rule's description into the alert reports,
# otherwise it will be excluded (thus rules's descriptions will be an empty string in the reports)
# Excluding rules's descriptions will reduce the size of reports.
}
engine {
thread-nb = 0 # the number of security threads per one probe thread , e .g . , if we have 16 probe threads and thread-nb = x ,
# then x*16 security threads will be used .
# If set to zero this means that the security analysis will be done by the threads of the probe .
exclude-rules = "0-89,100-200" # Range of rules to be excluded from the verification
rules-mask = "" # Mapping of rules to the security threads:
# Format: rules-mask = (thread-index:rule-range);
# thread-index = a number greater than 0
# rule-range = number greater than 0, or a range of numbers greater than 0.
# Example: If we have thread-nb = 3 and "(1:1,2,4-6)(2:3)" ,
# this means that:
# thread 1 verifies rules 1 ,2 ,4 ,5 ,6;
# thread 2 verifies only rule 3; and
# thread 3 verifies the rest
# Note: if we have thread-nb = 2 and "(1:1)(2:3)", then only rules 1 and 3 are verified (the others are not)
ip-encapsulation-index = LAST # If traffic is ip-in-ip, this option selects which IP will be analysed.
# - FIRST: first ip in the protocol hierarchy
# - LAST: last ip in the protocol hierarchy
# - i: i-th ip in ther protocol hierarchy.
# For example, given ETH.IP.UDP.GTP.IP.TCP.VPN.IP.SSL,
# - FIRST, or 1, indicates IP after ETH
# - LAST, or any number >= 3, indicates IP after VPN
# - 2 indicates IP after GTP
# NOTE: this option will be ignored in non ip-in-ip traffic
# number of fsm instances of one rule
max-instances = 100000
}
# A mem_pool contains several pools. Each pool stores several blocks of memory
# having the same size.
# This parameter set the maximum elements of a pool.
mempool {
# This parameter set the Maximum bytes of a pool: 2 GBytes
max-bytes = 2000000000
# Max number of elements in a pool
max-elements = 1000
# maximum size, in bytes, of a report received from mmt-probe
max-message-size = 3000
# Number of reports can be stored in a ring buffer
smp-ring-size = 1000
}
forward
{
enable = true
output-nic = "lo"
nb-copies = 200000 #number of copies of a packet to be sent
snap-len = 0 #specifies the snapshot length to be set on the handle.
promisc = 1 #specifies whether the interface is to be put into promiscuous mode. If promisc is non-zero, promiscuous mode will be set, otherwise it will not be set.
default = DROP #default action when packets are not selected/satisfied by any rule
# either FORWARD to forward the packets or DROP to drop the packets
#forward packets to a target using SCTP protocol: MMT will be a SCTP client,
# - it connects to the given "sctp-host" at "sctp-port"
# - the SCTP packets' payload will be sent to the target using this SCTP connection
target-protocols = { SCTP}
target-hosts = { "10.85.245.13" }
target-ports = { 38412}
}
When I send a pcap file to AMF I am getting the below messages in amf.log
**yjq@ubuntu:/mnt/hgfs/job/5greplay-0.0.1$ sudo tail -f /var/log/open5gs/amf.log
12/13 06:27:02.912: [amf] INFO: [Added] Number of gNBs is now 1 (../src/amf/context.c:1232)
12/13 06:27:02.913: [amf] INFO: gNB-N2[127.0.0.1] max_num_of_ostreams : 30 (../src/amf/amf-sm.c:781)
12/13 06:27:03.001: [amf] INFO: gNB-N2[127.0.0.1] connection refused!!! (../src/amf/amf-sm.c:793)
12/13 06:27:03.001: [amf] INFO: [Removed] Number of gNBs is now 0 (../src/amf/context.c:1259)
12/13 06:27:04.937: [amf] INFO: gNB-N2 accepted[127.0.0.1]:57871 in ng-path module (../src/amf/ngap-sctp.c:114)
12/13 06:27:04.937: [amf] INFO: gNB-N2 accepted[127.0.0.1] in master_sm module (../src/amf/amf-sm.c:742)
12/13 06:27:04.978: [amf] INFO: [Added] Number of gNBs is now 1 (../src/amf/context.c:1232)
12/13 06:27:04.978: [amf] INFO: gNB-N2[127.0.0.1] max_num_of_ostreams : 30 (../src/amf/amf-sm.c:781)
12/13 06:27:05.041: [amf] INFO: gNB-N2[127.0.0.1] connection refused!!! (../src/amf/amf-sm.c:793)
12/13 06:27:05.041: [amf] INFO: [Removed] Number of gNBs is now 0 (../src/amf/context.c:1259)**
I was writing an XML file to specifically replay an Authentication request in offline mode, using 'test2.pcap' as the input. However, upon inspecting the logs and using Wireshark, I noticed that 5greplay had replayed all the packets from the pcap file I provided(There are 1,942 messages in tset2.pcap, and log shows that it replays all 1,942 messages), instead of just the single packet I intended.
I don't know what went wrong. Because neither open5gs nor 5greplay has reported any errors. I have no way to start.I would be deeply grateful to anyone who can provide insights or answers to my questions.
I used the following command:
sudo ./5greplay replay -t test2.pcap -Xforward.nb-copies=1 -Xforward.default=FORWARD > log.txt 2>&1
Here are the rules I used, the log output from 5grepaly, and the input pcap files I used and the pcap files I captured on replay
The xml file is as follows:
<beginning>
<embedded_functions><![CDATA[
static void em_forward(
const rule_info_t *rule, int verdict, uint64_t timestamp,
uint64_t counter, const mmt_array_t * const trace ){
const char* trace_str = mmt_convert_execution_trace_to_json_string( trace, rule );
//forward the original packet (without any modification)
forward_packet();
}
]]></embedded_functions>
<property property_id="99" type_property="FORWARD" description="Replay the Authentication request"
if_satisfied="em_forward">
<event value="COMPUTE" event_id="1"
description="Downlink NAS Transport, Authentication request"
boolean_expression="((ngap.procedure_code == 4) && (nas_5g.message_type == 86))"/>
</property>
</beginning>
My 5greplay log is as follows:
mmt-5greplay: 5Greplay v0.0.7-eaef12c using DPI v1.7.10 (6dc79073) is running on pid 9174
mmt-5greplay: Overridden value of configuration parameter 'forward.nb-copies' by '1'
mmt-5greplay: Overridden value of configuration parameter 'forward.default' by '0'
mmt-5greplay: MMT-5Greplay 0.0.7 (eaef12c - Dec 13 2023 20:57:47) is verifying 1 rules having 2 proto.atts using the main thread
mmt-5greplay: Registered attribute to extract: 903.1
mmt-5greplay: Registered attribute to extract: 904.2
mmt-5greplay: Analyzing pcap file test2.pcap
1942 packets received
1942 messages received
1 alerts generated
mmt-5greplay: Number of packets being successfully forwarded: 1942, dropped: 0
Number of packets being successfully forwarded: 1942, dropped: 0
- rule 99 generated 1 verdicts
The following is the pcap file:
pcapfile.zip
When reading the documentation on rule xml semantics it is not apparant how the property tree is constructed.
The documentation does not give examples of operator attributes and sample rules do not contain code examples,
making it hard to construct complex rules.
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1# sudo ./5greplay replay -t 5g-sa.pcap -Xforward.nb-copies=2000 -Xforward.default=FORWARD > log.txt 2>&1
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1# sudo ./5greplay replay -t 5g-sa.pcap -Xforward.nb-copies=2000 -Xforward.default=FORWARD > log.txt 2>&1 &
[1] 2645
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1# sudo tail -f /var/log/open5gs/amf.log
tail: cannot open '/var/log/open5gs/amf.log' for reading: No such file or directory
tail: no files remaining
[1]+ Exit 6 sudo ./5greplay replay -t 5g-sa.pcap -Xforward.nb-copies=2000 -Xforward.default=FORWARD > log.txt 2>&1
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1#
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1#
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1# ll
total 40712
drwxrwxrwx 1 ztms ztms 512 Nov 15 20:26 ./
drwxrwxrwx 1 ztms ztms 512 Nov 15 19:37 ../
-rwxrwxrwx 1 ztms ztms 7938787 Aug 31 23:30 5g-sa.pcap*
-rwxrwxrwx 1 ztms ztms 33738992 Sep 9 2021 5greplay*
-rwxrwxrwx 1 ztms ztms 466 Nov 15 20:30 log.txt*
-rwxrwxrwx 1 ztms ztms 4090 Sep 9 2021 mmt-5greplay.conf*
drwxrwxrwx 1 ztms ztms 512 Sep 9 2021 plugins/
drwxrwxrwx 1 ztms ztms 512 Sep 9 2021 rules/
root@DESKTOP-GV66BO4:/mnt/d/桌面/社招/5greplay-0.0.1# tail -f log.txt
mmt-5greplay: 5Greplay v0.0.1-d9f4cef using DPI v1.7.0.0 (a8ad3c2) is running on pid 2646
mmt-5greplay: Overridden value of configuration parameter 'forward.nb-copies' by '2000'
mmt-5greplay: Overridden value of configuration parameter 'forward.default' by '0'
mmt-5greplay: Ignore duplicated rule id 103 (Inject only packet from UE -> Core but not inversed direction)
mmt-5greplay: [_sctp_connect:46] Cannot create SCTP socket
mmt-5greplay: Interrupted by signal 6
When compiling a rule using compile
command, there is an error:
fatal error: plugin_header.h: No such file or directory
#include "plugin_header.h"
^~~~~~~~~~~~~~~~~
compilation terminated.
Hello,
I want to install 5GReplay from the source using the following tutorial (because I'm using Ubuntu 22.04.2 LTS): https://github.com/Montimage/5Greplay/tree/main/docs/docs/guide/building-from-source
However, after I clone the repository, I can't find the 'lib' folder (please see here), thus, the rest of the installation process can't be done. Can you please let me know how to install it?
Thank you.
While experimenting with the OFFLINE replay feature I noticed that packets from some pcap files are not being forwarded.
Run command:
sudo ./5greplay replay -t pcap/capture_gnb_registration_ue_registration_full.pcap
Output:
mmt-5greplay: 5Greplay v0.0.4-7e7c4c6 using DPI v1.7.0.0 (a8ad3c2) is running on pid 4674
mmt-5greplay: MMT-5Greplay 0.0.4 (7e7c4c6 - Jan 31 2022 12:34:47) is verifying 1 rules having 2 proto.atts using the main thread
mmt-5greplay: Analyzing pcap file pcap/capture_gnb_registration_ue_registration_full.pcap
22 packets received
22 messages received
0 alerts generated
mmt-5greplay: Number of packets being successfully forwarded: 44, dropped: 0
Number of packets being successfully forwarded: 44, dropped: 0
<beginning>
<embedded_functions><![CDATA[
]]></embedded_functions>
![wireshark_output](https://user-images.githubusercontent.com/57671791/151793572-5b688222-febb-415d-9b35-746500ad17d8.PNG)
<property property_id="1" delay_units="ms" delay_min="0" delay_max="0"
type_property="FORWARD" description="Packet sent by open5gs Access and Mobility Management Function (AMF).">
<event event_id="1" value="COMPUTE"
description="Sent by AMF."
boolean_expression="( ( sctp.src_port == 38412 ) && ( #is_same_ipv4(ip.src, '127.0.0.5' ) ) )"/>
</property>
</beginning>
# option only when using DPDK to capture packets or to forwarding packets
dpdk-option = "--syslog=syslog --log-level=5 -c 0x55555555555"
#root stack of network protocol
# for Ethernet: 1
# for ieee802154: 800
# for Linux cooked capture: 624
stack-type = 1
input {
# in case for PCAP the input mode can be ONLINE or OFFLINE, however for DPDK it's only ONLINE
mode = OFFLINE
# input source for PCAP online mode (interface name) and for offline mode (pcap name),
# however for DPDK its interface port number
# in DPDK mode, MMT supports also multi-port inputs,
# - e.g., source="0,1" will tell MMT to capture packets on port 0 and 1
# - MMT will aggregate traffic on these 2 ports, thus 2 packets of one flow can be received on 2 different ports
source = "lo"
# maximal size of a packet
snap-len = 65535 #
}
output {
enable = false
output-dir = "./" # Location where files are written:
sample-interval = 5 #a new sample file is created each x seconds given by output.cache-period
report-description = true # true to include rule's description into the alert reports,
# otherwise it will be excluded (thus rules's descriptions will be an empty string in the reports)
# Excluding rules's descriptions will reduce the size of reports.
}
engine {
thread-nb = 0 # the number of security threads per one probe thread , e .g . , if we have 16 probe threads and thread-nb = x ,
# then x*16 security threads will be used .
# If set to zero this means that the security analysis will be done by the threads of the probe .
exclude-rules = "2-200" # Range of rules to be excluded from the verification
rules-mask = "" # Mapping of rules to the security threads:
# Format: rules-mask = (thread-index:rule-range);
# thread-index = a number greater than 0
# rule-range = number greater than 0, or a range of numbers greater than 0.
# Example: If we have thread-nb = 3 and "(1:1,2,4-6)(2:3)" ,
# this means that:
# thread 1 verifies rules 1 ,2 ,4 ,5 ,6;
# thread 2 verifies only rule 3; and
# thread 3 verifies the rest
# Note: if we have thread-nb = 2 and "(1:1)(2:3)", then only rules 1 and 3 are verified (the others are not)
ip-encapsulation-index = LAST # If traffic is ip-in-ip, this option selects which IP will be analysed.
# - FIRST: first ip in the protocol hierarchy
# - LAST: last ip in the protocol hierarchy
# - i: i-th ip in ther protocol hierarchy.
# For example, given ETH.IP.UDP.GTP.IP.TCP.VPN.IP.SSL,
# - FIRST, or 1, indicates IP after ETH
# - LAST, or any number >= 3, indicates IP after VPN
# - 2 indicates IP after GTP
# NOTE: this option will be ignored in non ip-in-ip traffic
# number of fsm instances of one rule
max-instances = 100000
}
# A mem_pool contains several pools. Each pool stores several blocks of memory
# having the same size.
# This parameter set the maximum elements of a pool.
mempool {
# This parameter set the Maximum bytes of a pool: 2 GBytes
max-bytes = 2000000000
# Max number of elements in a pool
max-elements = 1000
# maximum size, in bytes, of a report received from mmt-probe
max-message-size = 3000
# Number of reports can be stored in a ring buffer
smp-ring-size = 1000
}
forward
{
enable = true
output-nic = "lo"
nb-copies = 2 #number of copies of a packet to be sent
snap-len = 0 #specifies the snapshot length to be set on the handle.
promisc = 1 #specifies whether the interface is to be put into promiscuous mode. If promisc is non-zero, promiscuous mode will be set, otherwise it will not be set.
default = FORWARD #default action when packets are not selected/satisfied by any rule
# either FORWARD to forward the packets or DROP to drop the packets
#forward packets to a target using SCTP protocol: MMT will be a SCTP client,
# - it connects to the given "sctp-host" at "sctp-port"
# - the SCTP packets' payload will be sent to the target using this SCTP connection
target-protocols = { SCTP, UDP}
target-hosts = { "127.0.0.5", "127.0.0.7" }
target-ports = { 38412, 2152 }
}
I am getting this error during compiling the rules. would you please guide me to resolve this issue?
root@20b28097c6b7:/root/5greplay-0.0.6# ./5greplay compile rules/4.nas-smc-replay-attack.so rules/4.nas-smc-replay-attack.xml
mmt-5greplay: 5Greplay v0.0.6-00c7cd6 using DPI v1.7.3 (86eba86) is running on pid 2881
rules/4.nas-smc-replay-attack.so.c:8:10: fatal error: plugin_header.h: No such file or directory
8 | #include "plugin_header.h"
| ^~~~~~~~~~~~~~~~~
compilation terminated.
Hello!
Thanks for the great project.
Is there any plan to support the PFCP protocol in 5Greplay?
When I send a pcap file to AMF I am getting the below messages in amf.log
Error:
Warning:Failed to Decode ASN PDU
Warning:Failed to decode NGAP pdu
Error:Cannot deocde NGAP Message
I am sending the default pcap file provided
Below is the screenshot
5gCore:OPEN5GS
Config file:
# option only when using DPDK to capture packets or to forwarding packets
dpdk-option = "--syslog=syslog --log-level=5 -c 0x55555555555"
#root stack of network protocol
# for Ethernet: 1
# for ieee802154: 800
# for Linux cooked capture: 624
stack-type = 624
input {
# in case for PCAP the input mode can be ONLINE or OFFLINE, however for DPDK it's only ONLINE
mode = ONLINE
# input source for PCAP online mode (interface name) and for offline mode (pcap name),
# however for DPDK its interface port number
# in DPDK mode, MMT supports also multi-port inputs,
# - e.g., source="0,1" will tell MMT to capture packets on port 0 and 1
# - MMT will aggregate traffic on these 2 ports, thus 2 packets of one flow can be received on 2 different ports
source = "lo"
# maximal size of a packet
snap-len = 65535 #
}
output {
enable = true
output-dir = "./" # Location where files are written:
sample-interval = 5 #a new sample file is created each x seconds given by output.cache-period
report-description = true # true to include rule's description into the alert reports,
# otherwise it will be excluded (thus rules's descriptions will be an empty string in the reports)
# Excluding rules's descriptions will reduce the size of reports.
}
engine {
thread-nb = 0 # the number of security threads per one probe thread , e .g . , if we have 16 probe threads and thread-nb = x ,
# then x*16 security threads will be used .
# If set to zero this means that the security analysis will be done by the threads of the probe .
exclude-rules = "" # Range of rules to be excluded from the verification
rules-mask = "" # Mapping of rules to the security threads:
# Format: rules-mask = (thread-index:rule-range);
# thread-index = a number greater than 0
# rule-range = number greater than 0, or a range of numbers greater than 0.
# Example: If we have thread-nb = 3 and "(1:1,2,4-6)(2:3)" ,
# this means that:
# thread 1 verifies rules 1 ,2 ,4 ,5 ,6;
# thread 2 verifies only rule 3; and
# thread 3 verifies the rest
# Note: if we have thread-nb = 2 and "(1:1)(2:3)", then only rules 1 and 3 are verified (the others are not)
ip-encapsulation-index = LAST # If traffic is ip-in-ip, this option selects which IP will be analysed.
# - FIRST: first ip in the protocol hierarchy
# - LAST: last ip in the protocol hierarchy
# - i: i-th ip in ther protocol hierarchy.
# For example, given ETH.IP.UDP.GTP.IP.TCP.VPN.IP.SSL,
# - FIRST, or 1, indicates IP after ETH
# - LAST, or any number >= 3, indicates IP after VPN
# - 2 indicates IP after GTP
# NOTE: this option will be ignored in non ip-in-ip traffic
# number of fsm instances of one rule
max-instances = 100000
}
# A mem_pool contains several pools. Each pool stores several blocks of memory
# having the same size.
# This parameter set the maximum elements of a pool.
mempool {
# This parameter set the Maximum bytes of a pool: 2 GBytes
max-bytes = 2000000000
# Max number of elements in a pool
max-elements = 1000
# maximum size, in bytes, of a report received from mmt-probe
max-message-size = 3000
# Number of reports can be stored in a ring buffer
smp-ring-size = 1000
}
forward
{
enable = true
output-nic = "lo"
nb-copies = 1 #number of copies of a packet to be sent
snap-len = 0 #specifies the snapshot length to be set on the handle.
promisc = 1 #specifies whether the interface is to be put into promiscuous mode. If promisc is non-zero, promiscuous mode will be set, otherwise it will not be set.
default = DROP #default action when packets are not selected/satisfied by any rule
# either FORWARD to forward the packets or DROP to drop the packets
#forward packets to a target using SCTP protocol: MMT will be a SCTP client,
# - it connects to the given "sctp-host" at "sctp-port"
# - the SCTP packets' payload will be sent to the target using this SCTP connection
target-protocols = { SCTP, UDP}
target-hosts = { "172.22.0.10", "172.22.0.7"}
target-ports = { 38412, 2152 }
}
Hi,
I'm trying to use your tool 5greplay with open5gs. I have exact configuration like you have on your git page. AMF ip is 127.0.0.5.
But I cannot get 5greplay to connect with NGAP protocol. After initical SCTP setup, I get SCTP shutdown from 5greplay.
When I replay included sa.pcap:
~/5greplay$ sudo ./5greplay replay -t pcap/sa.pcap -Xforward.default=FORWARD
mmt-5greplay: 5Greplay v0.0.8-86f2074 using DPI v1.7.10 (35f0ad71) is running on pid 48876
mmt-5greplay: Overridden value of configuration parameter 'forward.default' by '0'
mmt-5greplay: Binded successfully socket to 127.0.0.1:0 using SCTP.
mmt-5greplay: MMT-5Greplay 0.0.8 (86f2074 - Mar 29 2024 14:06:03) is verifying 1 rules having 2 proto.atts using the main thread
mmt-5greplay: Registered attribute to extract: 904.2
mmt-5greplay: Registered attribute to extract: 904.3
mmt-5greplay: Analyzing pcap file pcap/sa.pcap
mmt-5greplay: Statistics of forwarded packets 30971.00 pps (total: 30971 packets), 38898376.00 bps
Statistics of forwarded packets 30971.00 pps (total: 30971 packets), 38898376.00 bps
And from amf:
04/03 14:03:27.244: [core] WARNING: Failed to decode ASN-PDU [code:2,consumed:0] (../lib/asn1c/util/message.c:69)
04/03 14:03:27.244: [ngap] WARNING: Failed to decode NGAP-PDU (../lib/ngap/message.c:53)
04/03 14:03:27.244: [amf] ERROR: Cannot decode NGAP message (../src/amf/amf-sm.c:824)
04/03 14:03:27.288: [amf] INFO: gNB-N2[127.0.0.1] connection refused!!! (../src/amf/amf-sm.c:793)
04/03 14:03:27.288: [amf] INFO: [Removed] Number of gNBs is now 0 (../src/amf/context.c:1258
I attached 2 pcap. One is when I send mesage
damir_replay.zip
damir.zip
damir_replay.zip
damir.zip
s from simulator to open5gs: damir.pcap
And other is when I run damir.pcap with 5greplay: damir-replay.pcap
my5G-RANTester, 5greplay and open5gs are all installed in the same VM
Thank you in advance for any help
I want to use the get_numeric_value and set_numeric_value functions in an embedded function to conduct fuzz testing, but I find it hard to use the required att_id. The embedded function
static inline void em_testing( const rule_info_t *rule, int verdict, uint64_t timestamp,
uint64_t counter, const mmt_array_t * const trace ) {
uint64_t procedure_code = get_numeric_value( PROTO_NGAP, NGAP_ATT_PROCEDURE_CODE, 1, trace );
uint64_t p_hdr = get_numeric_value( PROTO_NGAP, NGAP_ATT_P_HDR, 1, trace );
uint64_t p_data = get_numeric_value( PROTO_NGAP, NGAP_ATT_P_DATA, 1, trace );
uint64_t p_payload = get_numeric_value( PROTO_NGAP, NGAP_ATT_P_PAYLOAD, 1, trace );
uint64_t payload_count = get_numeric_value( PROTO_NGAP, NGAP_ATT_PAYLOAD_COUNT, 1, trace );
uint64_t stats = get_numeric_value( PROTO_NGAP, NGAP_ATT_STATS, 1, trace );
}
produces the following output when compiled:
mmt-5greplay: 5Greplay v0.0.4-7e7c4c6 using DPI v1.7.0.0 (a8ad3c2) is running on pid 5627
rules/NGSetupResponse.so.c: In function ‘em_testing’:
rules/NGSetupResponse.so.c:33:53: error: ‘NGAP_ATT_P_HDR’ undeclared (first use in this function); did you mean ‘S1AP_ATT_UE_ID’?
uint64_t p_hdr = get_numeric_value( PROTO_NGAP, NGAP_ATT_P_HDR, 1, trace );
^~~~~~~~~~~~~~
S1AP_ATT_UE_ID
rules/NGSetupResponse.so.c:33:53: note: each undeclared identifier is reported only once for each function it appears in
rules/NGSetupResponse.so.c:35:54: error: ‘NGAP_ATT_P_DATA’ undeclared (first use in this function); did you mean ‘NGAP_ATT_P_HDR’?
uint64_t p_data = get_numeric_value( PROTO_NGAP, NGAP_ATT_P_DATA, 1, trace );
^~~~~~~~~~~~~~~
NGAP_ATT_P_HDR
rules/NGSetupResponse.so.c:37:57: error: ‘NGAP_ATT_P_PAYLOAD’ undeclared (first use in this function); did you mean ‘NGAP_ATT_P_DATA’?
uint64_t p_payload = get_numeric_value( PROTO_NGAP, NGAP_ATT_P_PAYLOAD, 1, trace );
^~~~~~~~~~~~~~~~~~
NGAP_ATT_P_DATA
rules/NGSetupResponse.so.c:39:61: error: ‘NGAP_ATT_PAYLOAD_COUNT’ undeclared (first use in this function); did you mean ‘NGAP_ATT_P_PAYLOAD’?
uint64_t payload_count = get_numeric_value( PROTO_NGAP, NGAP_ATT_PAYLOAD_COUNT, 1, trace );
^~~~~~~~~~~~~~~~~~~~~~
NGAP_ATT_P_PAYLOAD
rules/NGSetupResponse.so.c:41:53: error: ‘NGAP_ATT_STATS’ undeclared (first use in this function); did you mean ‘NGAP_ATT_P_DATA’?
uint64_t stats = get_numeric_value( PROTO_NGAP, NGAP_ATT_STATS, 1, trace );
^~~~~~~~~~~~~~
NGAP_ATT_P_DATA
mmt-5greplay: Cannot encode rule "rules/NGSetupResponse.xml". Check options.
with only the procedure code being accepted. Is there a list of already supported attributes?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.