EFForg/rayhunter

rayhunter-check not give the warning even if SIB7 appear

開放

#719 建立於 2025年12月2日

 (9 則留言) (1 個反應) (1 位負責人)Rust (465 個分叉)github user discovery
enhancementhelp wanted

倉庫指標

星標
 (5,521 顆星)
PR 合併指標
 (平均合併 5天 12小時) (30 天內合併 6 個 PR)

描述

i Collect my PCAP with SIB7 shown in frame 839, im using SCAT

Kindly see the snapshot below

I run the rayhunter-check: ./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap

but the output just like below: INFO [rayhunter_check] Analyzers: INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell. INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities. INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0) INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped

show-skipped curious with 1230 messages that skipped, i run again with --show-skipped ./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap --show-skipped INFO [rayhunter_check] Analyzers: INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell. INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities. INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0) INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: messages skipped: INFO [rayhunter_check] - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)" INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped (base) ahmadrifky@ahmads-mbp-2 rayhunter-check-macos-intel %

instead got new error - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"

looking forward for your resolution

貢獻者指南