Wireshark TCP/HTTP Connections

[atharvakale343]

SUMMARY
Thank you for writing this amazing tool. I was trying to capture a HTTP unencrypted request on the 5G SA UE Data Plane. To do this, I made a curl request using HTTP 1.0 from the android adb shell to http://gaia.cs.umass.edu. Although, I can see the TCP segments in the Wireshark dump initiating a connection and getting a response through port 80 on a web server, it seems like the payload isn't included in the dump. As such, Wireshark cannot make this out as a HTTP frame.

STEPS TO REPRODUCE
Steps to reproduce the behavior:

1. Run SCAT with scat -t qc -u -a 020:002 -i 0 -H 127.0.0.2
2. Start up wireshark in the background listening to localhost 127.0.0.2
3. Run adb shell on the smartphone, followed by curl --http1.0 http://gaia.cs.umass.edu
4. Find a frame that looks something like

EXPECTED and ACTUAL RESULT
TCP Frame should include the payload of the HTTP request.

ENVIRONMENT

• OS: macOS
• SCAT version: master
• Python version: [e.g. 3.12]
• Cellular device: OnePlus Nord CE Lite 3 5G
• Baseband type: Qualcomm
• DIAG method: USB

ADDITIONAL INFORMATION
5G NR

[atharvakale343]

@peremen apologies for tagging, but would you happen to have any insight on this? I’m happy to investigate the code base if you have any potential strategies in mind.

[peremen]

It is usually considered rude for pinging in less than two days apart. I do not have a commercial contract or obligation regarding processing the issues.

There are duplicate packets in the trace: 310/311, 312/313 looks the same, but I don't think there was an actual retransmission. And I also recommend understanding how TCP handshake works: https://www.sciencedirect.com/topics/computer-science/three-way-handshake The packet 310 is a TCP SYN packet, which usually does not contain the payload (Len=0). The packet 312: for whatever reason, the server did not want to establish a TCP connection, therefore answering with FIN+ACK packet. Since the original sequence number was 0, ack number is then 1, server's sequence number was 85.

[atharvakale343]

Apologies again--this shows my in-experience with the open-source community, and that I need to get better at communicating.

I will look into this deeper. Thank you.