EFForg/rayhunter

rayhunter-check not give the warning even if SIB7 appear

Offen

#719 geöffnet am 02.12.2025

 (9 Kommentare) (1 Reaktion) (1 zugewiesene Person)Rust (465 Forks)github user discovery
enhancementhelp wanted

Repository-Metriken

Stars
 (5.521 Sterne)
PR-Merge-Metriken
 (Durchschn. Merge 5T 12h) (6 gemergte PRs in 30 T)

Beschreibung

i Collect my PCAP with SIB7 shown in frame 839, im using SCAT

Kindly see the snapshot below

I run the rayhunter-check: ./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap

but the output just like below: INFO [rayhunter_check] Analyzers: INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell. INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities. INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0) INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped

show-skipped curious with 1230 messages that skipped, i run again with --show-skipped ./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap --show-skipped INFO [rayhunter_check] Analyzers: INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell. INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities. INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0) INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: messages skipped: INFO [rayhunter_check] - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)" INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped (base) ahmadrifky@ahmads-mbp-2 rayhunter-check-macos-intel %

instead got new error - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"

looking forward for your resolution

Contributor Guide