rayhunter-check not give the warning even if SIB7 appear
- Dominant language
- Rust
- Stars
- 5.8k
- Forks
- 490
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 23
Description
i Collect my PCAP with SIB7 shown in frame 839, im using SCAT
Kindly see the snapshot below
I run the rayhunter-check:
./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap
**but the output just like below:**
INFO [rayhunter_check] Analyzers:
INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message
INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell.
INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities.
INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0)
INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command
INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs
INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap
INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped
**show-skipped**
curious with 1230 messages that skipped, i run again with --show-skipped
./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap --show-skipped
INFO [rayhunter_check] Analyzers:
INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message
INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell.
INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities.
INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0)
INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command
INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs
INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap
INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: messages skipped:
INFO [rayhunter_check] - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"
INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped
(base) ahmadrifky@ahmads-mbp-2 rayhunter-check-macos-intel %
instead got new error - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"
looking forward for your resolution
Contributor guide
Assessment
This issue has not been assessed yet.