Understanding ISO 8583 messaging log

Question

I read about ISO 8583 messaging at WIKI and Code Project; I understood ISO 8583 messages can basically be divided in 3 parts:

1. MTI (Message Type Indicator)

Answer 1

A good online bitmap analysis tool is https://neapay.com/online-tools/bitmap-fields-decoder.html.

Sometime helps the https://codebeautify.org/hex-string-converter tool.

For a better understanding of the ISO 8583 message format, it is useful to analyse each field manually. However, each field can have length and value subfields in different formats (BCD, EBCDIC, ASCII ...). And some fields may have inner fields, for example BMP 48 or 60 often used as containers for nested field trees. These inner fields may have tag, length and value. And nested fields of these fields may have different formats again :). For example the https://github.com/credibledoc/credible-doc/blob/master/iso-8583-packer/doc/ebcdic/ebcdic-decimal-tag-packer.md page describes a field with EBCDIC tag and BCD value.

You can use the https://github.com/credibledoc/credible-doc/tree/master/iso-8583-packer Java library (I am the author) for building ISO 8583 messages. The example of ISO message above can be unpacked and packed with the iso-8583-packer library.

Message data:

<f name="Root" lenHex="005B">
    <f name="Header" val="0110000000" valHex="30313130303030303030"/>
    <f name="MTI" val="0820" valHex="30383230"/>
    <f name="Bitmap" bitmapHex="80380000008100000400000000000000" bitSet="{1, 11, 12, 13, 41, 48, 70}">
        <f name="SystemTraceAuditNumber" fieldNum="11" val="362910" valHex="333632393130"/>
        <f name="LocalTransactionTimeHHMMSS" fieldNum="12" val="102957" valHex="313032393537"/>
        <f name="LocalTransactionDateMMDD" fieldNum="13" val="1031" valHex="31303331"/>
        <f name="TerminalId" fieldNum="41" val="10000005" valHex="3130303030303035"/>
        <f name="PrivateData_48" fieldNum="48" val="SU20111031102957201110311029573" lenHex="303331" valHex="53553230...39353733"/>
        <f name="NetworkManagementInformationCode" fieldNum="70" val="001" valHex="303031"/>
    </f>
</f>

Message Structure:

<f type="LEN_VAL" name="Root" lengthPacker="BinaryLengthPacker" bodyPacker="AsciiBodyPacker">
    <f type="VAL" name="Header" bodyPacker="AsciiBodyPacker" len="10"/>
    <f type="VAL" name="MTI" bodyPacker="AsciiBodyPacker" len="4"/>
    <f type="BIT_SET" name="Bitmap" bitMapPacker="IfbBitmapPacker">
        <f type="VAL" fieldNum="11" name="SystemTraceAuditNumber" bodyPacker="AsciiBodyPacker" len="6"/>
        <f type="VAL" fieldNum="12" name="LocalTransactionTimeHHMMSS" bodyPacker="AsciiBodyPacker" len="6"/>
        <f type="VAL" fieldNum="13" name="LocalTransactionDateMMDD" bodyPacker="AsciiBodyPacker" len="4"/>
        <f type="VAL" fieldNum="41" name="TerminalId" bodyPacker="AsciiBodyPacker" len="8"/>
        <f type="LEN_VAL" fieldNum="48" name="PrivateData_48" lengthPacker="AsciiLengthPacker" bodyPacker="AsciiBodyPacker"/>
        <f type="VAL" fieldNum="70" name="NetworkManagementInformationCode" bodyPacker="AsciiBodyPacker" len="3"/>
    </f>
</f>

The example above can be found on GitHub https://github.com/credibledoc/credible-doc/blob/master/iso-8583-packer/src/test/java/com/credibledoc/iso8583packer/examples/UnderstandingIso8583MessageLogTest.java

BMP 55 often contains TLV EMV data. The https://paymentcardtools.com/emv-tlv-parser tool is useful in the case.

Answer 2

Got it,
This message is divided as follows:

First 2 bytes are the message length 00 5B = 91
Followed by 14 bytes of header = 01100000000820

Followed somehow by BMP as follows:

• Primary BMP = 80 38 00 00 00 81 00 00 = Fields {1, 11,12, 13, 41, 48} exist
  Field 1 means secondary BMP exist
• Secondary BMP = 04 00 00 00 00 00 00 00 = Field 70 exist

I am not sure where is MTI, will it be the 0820 at the trailer of the header? since it is in ASCII and usually it comes in numeric value of 08 20 but this might be part of the specs. 0820 means network management advice

anyways, the fields from the decoded BMP as follows:

• DE 11 = 362910
  System Trace Audit Number
• DE 12 = 102957
  Local transaction time hh(24)mmss
• DE 13 = 1031
  Local transaction date MMDD
• DE 41 = 10000005
  terminal ID
• DE 48 = (031) SU20111031102957201110311029573
  notice the 3 digits length field preceding the remaining data in this field. which is a generic (future/private use) field
• DE 70 = 001
  network management information code <001 = sign on>

From DE 70 value 001 this is a sign on message, which must be a 0800 MTI.

To get more information about the location of the MTI and the meaning of DE 48, you should read the manual (technical specs) of this device to get more information.

Answer 3

while sending ISO 8583 message we are converting it in BCD/HEX form ,use Wireshark tool to

track communication between IP and Ports.