PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1

[hack-char]

I'm curious if anyone has seen these errors, and am trying to figure out what they mean. I've gotten quite a few of them, all the same message:

{
    "timestamp": "2025-03-11T10:08:01.283027356-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))"
    ],
    "analysis": []
  }

The timestamp doesn't line up to an entry in the pcap. I'm assuming this means some error on-device when either a hardware error occurs or some kind of decoding error. Any idea how to troubleshoot?

Installed RayHunter from tag v0.2.5 to an Orbic. Install seemed fine and can access the web UI.

Thanks, Char

[wisxxx]

yes. Installed the latest (as of yesterday). I just took it out for an hour or so and got:

{ "Timestamp": "2025-03-11T12:02:41.369860975-04:00", "skipped_message_reasons": [ "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))", "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))" ], "analysis": [] },

... 141 repetitions of "BufferTooShort" skipped ...

{ "Timestamp": "2025-03-11T16:17:47.304485585-04:00", "skipped_message_reasons": [ "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))" ], "analysis": [] }

This is on an Orbic with a SIM, but no active account on Verizon. USB and WiFi web interfaces both accessible.

[wgreenberg]

on the bright side, this error is fairly benign -- it just means our telcom parser is failing to parse a certain type of message. we should figure out which type and fix it, though!

[happilyretired23]

Same here. Inactive SIM. Orbic UI shows "NO SERVICE". Anything we can do to provide info to help debug?

[wisxxx]

I believe it only occurs when the web page is displayed. I see it over USB for a certainty, occurring every minute or two. Disconnecting and walking around with the Orbic in my pocket for over two hours, there were no errors. They started up when I reconnected to USB.

[cooperq]

This is a benign error you can ignore.

[cooperq]

oops apparently @wgreenberg plans to fix it eventually!

[m0xsec]

Sharing a subset of the errors I got - glad to hear it is benign and someone is on it to fix it!

  {
    "timestamp": "2025-04-02T18:35:55.562339161-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 11, Remaining bits 8\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-02T18:44:04.342964878-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-02T18:46:22.761974291-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 11, Remaining bits 8\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-02T18:47:25.501994048-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-02T18:51:42.793702273-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 11, Remaining bits 8\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-02T18:52:21.055785795-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-02T18:54:27.756468193-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1\", context: [] }))"
    ],
    "analysis": []

[m0xsec]

on the bright side, this error is fairly benign -- it just means our telcom parser is failing to parse a certain type of message. we should figure out which type and fix it, though!

i assume one could compare the timestamp w/ the raw PCAP to what is failing to parse? wondering what the best way to dig into this would be - seeing the error a lot on my end too

[m0xsec]

In Wireshark I see even their protocol parser for GSMTAP/NAS-EPS is struggling with PDN connectivity requests (Non-Access-Stratum PDU) and some others. Is that similar to what is happening with our telcom parser, maybe?

[AlienMajik]

I am also getting the same errors with a active sim card on a verizon and also with a tmobile network:

Analysis Report of Current Capture

[{“analyzers”: [{“name”: “IMSI Requested”,“description”: “Tests whether the ME sends an IMSI Identity Request NAS message”},{“name”: “Connection Release/Redirected Carrier 2G Downgrade”,“description”: “Tests if a cell releases our connection and redirects us to a 2G cell.”},{“name”: “LTE SIB 6/7 Downgrade”,“description”: “Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities.”}],“rayhunter”: {“rayhunter_version”: “0.2.6”,“system_os”: “Linux 3.18.48”,“arch”: “armv7l”}},{“timestamp”: “2025-04-10T15:25:17.089490041-04:00”,“skipped_message_reasons”: [“DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: "PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1", context: [] }))”],“analysis”: []},{“timestamp”: “2025-04-10T15:26:00.708566327-04:00”,“skipped_message_reasons”: [“DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: "PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1", context: [] }))”],“analysis”: []},

[NyarlaCat]

I started getting this yesterday after I got a red line flagging some suspicious activity. I'm using a Spectrum SIM card. On the web UI I can no longer see that nice table to easily download logs. That's the biggest problem now.

Q: Is there any way to clear this out so that I can see the table on the web UI again?

It's pretty long but here's the full read out I see in the web UI.

Analysis Report of Current Capture
[
  ...
  {
    "timestamp": "2025-04-15T13:46:13.143567061-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 9, Remaining bits 0\", context: [] }))",
      "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: \"PerCodec:DecodeError:Requested Bits to decode 9, Remaining bits 0\", context: [] }))"
    ],
    "analysis": []
  },
  {
    "timestamp": "2025-04-15T13:51:06.350801480-04:00",
    "skipped_message_reasons": [
      "DecodingError(UperDecodeError(Error { cause: Generic, msg: \"The value should be 1 to 4\", context: [] }))"
    ],
    "analysis": []
  },
  // etc...
]

EDIT

So the real issue here was that there was a browser error. This was fixed by updating to the latest version of rayhunter

Uncaught (in promise) TypeError: Cannot read properties of null (reading 'message')
    at updateEntryAnalysisResult (main.js:84:70)
    at async updateAnalysisResults (main.js:97:13)
    at async populateDivs (main.js:21:5)
    at async repeatedlyPopulate (index.html:8:13)
updateEntryAnalysisResult @ main.js:84
await in updateEntryAnalysisResult
updateAnalysisResults @ main.js:97
await in updateAnalysisResults
populateDivs @ main.js:21
await in populateDivs
repeatedlyPopulate @ index.html:8
window.onload @ index.html:12

[jlariviere1]

Not sure if anyone cares, but the error is present for me in the latest version downloaded, 0.2.8 Connected over USB, host computer Manjaro, no V paid service, using Orbic RC400L with whatever firmware version it came from big A.

{ "timestamp": "[redacted]", "skipped_message_reasons": [ "DecodingError(UperDecodeError(Error { cause: BufferTooShort, msg: "PerCodec:DecodeError:Requested Bits to decode 3, Remaining bits 1", context: [] }))" ], "analysis": [] }