EFForg/rayhunter

rayhunter-check not give the warning even if SIB7 appear

Open

#719 opened on Dec 2, 2025

View on GitHub
 (9 comments) (1 reaction) (1 assignee)Rust (431 forks)github user discovery
enhancementhelp wanted

Repository metrics

Stars
 (5,271 stars)
PR merge metrics
 (PR metrics pending)

Description

i Collect my PCAP with SIB7 shown in frame 839, im using SCAT

Kindly see the snapshot below

I run the rayhunter-check: ./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap

but the output just like below: INFO [rayhunter_check] Analyzers: INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell. INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities. INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0) INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped

show-skipped curious with 1230 messages that skipped, i run again with --show-skipped ./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap --show-skipped INFO [rayhunter_check] Analyzers: INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell. INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities. INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0) INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: messages skipped: INFO [rayhunter_check] - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)" INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped (base) ahmadrifky@ahmads-mbp-2 rayhunter-check-macos-intel %

instead got new error - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"

looking forward for your resolution

Contributor guide