How a 5G Lab Capture Hid a Full VoNR Call Inside GTP Tunnels

·4 views

A bug report filed against the open-source srsRAN project involved a 5G F1-U interface capture that initially appeared to contain only GTP traffic, with no visible SIP signaling or RTP audio. The hidden content was recoverable because the lab network used NEA0 null ciphering and no SDAP header, meaning stripping a fixed 3-byte PDCP header from each GTP payload exposed 2,960 raw IPv4 packets underneath. Re-framing that data revealed a two-party Voice over New Radio (VoNR) call comprising 1,670 RTP frames and six SIP messages, including an IMS-AKA authentication exchange. The INVITE and subsequent call-control messages were absent from plain view because IMS specifications require all post-registration SIP signaling to travel inside an IPsec tunnel negotiated during the 401 challenge. The technique only works on test networks using NEA0; commercial deployments running NEA1 or NEA2 encryption would make the payload unrecoverable without the device's keys.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds full product with Claude Code in long sessions, skipping code review

Brazilian developer Alberto Souza built a complete software product end-to-end using Claude Code, an AI coding agent, across multiple long work sessions lasting up to four hours each. In the final session, the agent made 42 commits autonomously, coding an entire module with eight use cases, requiring only one manual adjustment. The product consists of three services — a Java core, a JavaScript AI agent, and a React front-end — and ended up with over 1,300 back-end tests and 800 agent tests. Souza deliberately chose not to review the generated code, focusing his effort entirely on structuring inputs and context for each iteration. His workflow involved delivering detailed context, prompting the AI to ask clarifying questions across multiple rounds, and only then allowing it to proceed with full implementation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches Free Web Scraping Toolkit at KitDecoder.com

A developer with several years of web scraping experience has launched a free toolkit called KitDecoder, available at kitdecoder.com. The platform consolidates multiple web scraping tools and resources into a single, centralized location. The project was motivated by the developer's repeated need to juggle various tools during scraping work. The toolkit is now publicly available and the creator is seeking feedback from the community.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer shares fail-closed checklist for safely deploying AI agent fleets each week

A software editor at Stackyard has published a structured Monday checklist designed to prevent costly errors when deploying AI agent systems at the start of each work week. The checklist follows a fail-closed principle, meaning any missing, unvalidated, or unrecognized input causes the agent to stop rather than proceed with assumptions. Key steps include diffing and validating tool schemas, running dry-run tests before enforcement, canirying a single agent before fleet-wide rollout, and capping token and spend budgets before enabling parallel or coordinator modes. The guide also emphasizes treating tool outputs and web-fetched content as untrusted data, ensuring destructive tools require explicit human approval, and pinning model IDs to avoid unexpected provider-side defaults. The author argues that starting each deployment cycle with strict schema validation and defined refusal paths reduces surprise failures and makes outcomes defensible in team reviews.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Company-Specific OA Prep Beats Generic LeetCode Grinding in 2026

A software engineering career advice post on DEV Community argues that job seekers preparing for 2026 online assessments are better served by targeting company-specific, recent problem patterns than by repeatedly drilling static lists like Blind 75 or NeetCode 150. The author notes that many OAs now feature stateful simulations, multi-part system problems, SQL window functions, and light design prompts that generic grind sets rarely cover. The core recommendation is to identify three to five active target companies, research the OA format each currently uses based on recent public candidate reports, and practice problems matching that specific shape under timed conditions. A simple weekly ritual is proposed: note the problem shape, solve under a timer, and write a short postmortem covering the pattern and key gotchas. The post positions fundamentals as still essential but warns against mistaking comfort with classic medium problems for readiness for a specific company's current screening format.

0 comments Read more at DEV Community