gtpv2

Documentation

Overview

Package gtpv2 decodes GTPv2-C — the GTP version-2 control plane (3GPP TS 29.274) that signals EPS bearer / session management across the LTE and 5G-NSA core (the S11 MME↔SGW, S5/S8 SGW↔PGW and S10/S16 interfaces, UDP port 2123). It is the control-plane companion to internal/gtp, which decodes the GTP-U user plane (TS 29.281) and explicitly defers GTP-C. GTP-C is a recognised telecom-security target: the roaming / core GTP plane has been abused for IMSI harvesting, subscriber tracking and the GTPdoor backdoor, and a captured Create-Session / Modify-Bearer exchange carries the subscriber's IMSI, MSISDN and MEI in the clear — so decoding it surfaces exactly those identifiers.

Wrap-vs-native judgement

Native. The GTPv2-C header is a fixed bitfield (version, the
piggyback / TEID / message-priority flags, message type, length,
optional TEID, sequence) and the body is a flat list of TLV
Information Elements (type, length, instance, value). Decoding is
byte-field extraction + a TLV walk — a dependency is not justified.
stdlib only, no new go.mod dep.

Verifiable / no confidently-wrong output

The header and the IE TLV structure were verified field-for-field
against scapy's GTPv2 layer. Message types and IE types are named
from the TS 29.274 tables. The subscriber-identifier IEs that are
TBCD-encoded — IMSI, MSISDN and MEI — are decoded to their digit
strings (the standard telephony BCD, the headline value for the
IMSI-harvesting use case); every other IE value is surfaced as raw
hex rather than decoded into a possibly-wrong field (the IE value
formats are many and version-specific).

Index

• type IE
• type Result
  • func Decode(input string) (*Result, error)

Types

type IE

type IE struct {
	Type     int    `json:"type"`
	TypeName string `json:"type_name"`
	Length   int    `json:"length"`
	Instance int    `json:"instance"`
	ValueHex string `json:"value_hex,omitempty"`
	Decoded  string `json:"decoded,omitempty"`
}

IE is one Information Element.

type Result

type Result struct {
	Version         int    `json:"version"`
	Piggybacked     bool   `json:"piggybacked"`
	TEIDPresent     bool   `json:"teid_present"`
	MessagePriority bool   `json:"message_priority_present"`
	MessageType     int    `json:"message_type"`
	MessageName     string `json:"message_name"`
	Length          int    `json:"length"`
	TEID            string `json:"teid,omitempty"`
	SequenceNumber  int    `json:"sequence_number"`

	IMSI   string `json:"imsi,omitempty"`
	MSISDN string `json:"msisdn,omitempty"`
	MEI    string `json:"mei,omitempty"`

	IEs   []IE     `json:"information_elements"`
	Notes []string `json:"notes,omitempty"`
}

Result is the decoded view of a GTPv2-C message.

func Decode

func Decode(input string) (*Result, error)

Decode parses a GTPv2-C message from hex (whitespace / ':' / '-' / '_' separators and a '0x' prefix tolerated).