Meanwhile discovered that 2 'identical' UE/MS (original+clone) were in use at the same time. Somehow the Diameter Signalling Controller (DSC) and respective Diameter Routing Agent (DRA) were confused by the twins (PCRF application shows troubles to indicate, did not block because Access Control Class (ACC) flag was high and therefore priviledged).
What artifacts can be evident to be unique at the original?
No physical device at hand only logs.
Rolf are you saying the UE/MS was communicating GC1?
Greg, yes that I got from the carrier NetEngineer. Its abnormal that the UE/MSs had such high ACCs but helped them that the clone came in, I guess otherwise PCRF had blocked to accept.
We study TS 23.468 Rel 13.3.0 at the time.
Weird case but FunToLearn -)
Greg, yes that I got from the carrier NetEngineer. Its abnormal that the UE/MSs had such high ACCs but helped them that the clone came in, I guess otherwise PCRF had blocked to accept.
We study TS 23.468 Rel 13.3.0 at the time.
Weird case but FunToLearn -)
Yer FunToLearn Rolf; unusual case and a lot involved for drug trafficking. NAS now becomes more significant beginning with scm1, scm2, scm3.
Greg, right. How the twins were able to get high ACC is a miracle because UICC-enclosed. Sorry for delayed updates
Greg, yes that I got from the carrier NetEngineer. Its abnormal that the UE/MSs had such high ACCs but helped them that the clone came in, I guess otherwise PCRF had blocked to accept.
We study TS 23.468 Rel 13.3.0 at the time.
Weird case but FunToLearn -)
Yer FunToLearn Rolf; unusual case and a lot involved for drug trafficking. NAS now becomes more significant beginning with scm1, scm2, scm3.
Hi Rolf did you manage to confirm with your contact the scm1, scm2 and scm3 of the target device e.g. were these fields filled in (can you show the data captured) or were they empty in the records?
Greg, did not forget you.
The scm1, scm2 and scm3 fields are empty. I ordered to re-check the whole part of the investigation
on NAS. They have to triple-check first. I fear to get on the wrong path by non-recognized technical failures or mis-interpretations.
The MNO was also avised to splunk all logs related to this case incl. the NMS (Nokia Siemens Networks NSN).
The risk to fail is high because they say kind of 1st time experience like this. But to reduce the risk to fail the balance to hold back pushing involved personal and the time running so fast is difficult, as I assume 'they' are testing for the BigBang soon.
Back to ESN I try to find out which application would probably beeing running as a background service to request the devices ESN. In my understanding the ESN has to be requested by an application otherwise it will not appear in the data traffic.
ESN I still hope on to divide the twins (orig and clone)
Once again sorry for delay and Thank you! for your help, Greg.
Greg, yes that I got from the carrier NetEngineer. Its abnormal that the UE/MSs had such high ACCs but helped them that the clone came in, I guess otherwise PCRF had blocked to accept.
We study TS 23.468 Rel 13.3.0 at the time.
Weird case but FunToLearn -)
Yer FunToLearn Rolf; unusual case and a lot involved for drug trafficking. NAS now becomes more significant beginning with scm1, scm2, scm3.
Hi Rolf did you manage to confirm with your contact the scm1, scm2 and scm3 of the target device e.g. were these fields filled in (can you show the data captured) or were they empty in the records?
Hi Rolf, no worries.
If no scm1, scm2 and scm3 then it may suggest no device involved at all.
Maybe check with your contact that no emergency & maintenance happening in network - as that would only allow 11-15 to function in local cell but 0-9 would have barred access.
Its abnormal that the UE/MSs had such high ACCs
Test card in type approval or engineering mode.
Greg, thank you. Did as you recommended.
Got confirmed that the twins were real and had ACC 14. Got advised to silence.