Understanding ISO 8583 messaging log

Question

I read about ISO 8583 messaging at WIKI and Code Project; I understood ISO 8583 messages can basically be divided in 3 parts:

1. MTI (Message Type Indicator)

1.1. Version

1.2. Message Class

1.3. Message Function

1.4. Message Origin

2. Bitmap

Indicate which data elements are present.

3. DataElement

The essence of the whole ISO message, contain information about the transaction such as:

• transaction type,

• amount,

• customerid, etc.

So, after reading these two web references, I want to make divide my ISO messaging log as MTI, bitmap, and Data Element.

For example:

(0800 2020000000800000   000000 000001 3239313130303031)
MTI:  0800 (1987 version, Network Management Message, Request, Acquirer)
Bitmap: 20 20 00 00 00 80 00 00 (eg. 20 = 0010 0000 ,so position 3 is on)
DataElement:(by seeing Bitmap , we can defined data element as follow)
    field 03:000000 (Processing Code)
    field 11:000001 (Systems trace audit number)
    field 41:3239313130303031 (Card acceptor terminal idenfication)

But my challenge is that I already have ISO 8583 messaging log from my ATM Machine.

This actual output messaging log is not very clear like the one in the snippet above.

So I cannot divide this message to MTI, Bitmap and Data element like upper example.

00000:00 5B 30 31 31 30 30 30 30 30 30 30 30 38 32 30 80 38 00 00  [.[01100000000820.8..]
00020:00 81 00 00 04 00 00 00 00 00 00 00 33 36 32 39 31 30 31 30  [............36291010]
00040:32 39 35 37 31 30 33 31 31 30 30 30 30 30 30 35 30 33 31 53  [2957103110000005031S]
00060:55 32 30 31 31 31 30 33 31 31 30 32 39 35 37 32 30 31 31 31  [U2011103110295720111]
00080:30 33 31 31 30 32 39 35 37 33 30 30 31                       [0311029573001       ]

I have no previous experience in ISO 8583 message and welcome suggestions.

Answer 1

Got it,
This message is divided as follows:

First 2 bytes are the message length 00 5B = 91
Followed by 14 bytes of header = 01100000000820

Followed somehow by BMP as follows:

• Primary BMP = 80 38 00 00 00 81 00 00 = Fields {1, 11,12, 13, 41, 48} exist
  Field 1 means secondary BMP exist
• Secondary BMP = 04 00 00 00 00 00 00 00 = Field 70 exist

I am not sure where is MTI, will it be the 0820 at the trailer of the header? since it is in ASCII and usually it comes in numeric value of 08 20 but this might be part of the specs. 0820 means network management advice

anyways, the fields from the decoded BMP as follows:

• DE 11 = 362910
  System Trace Audit Number
• DE 12 = 102957
  Local transaction time hh(24)mmss
• DE 13 = 1031
  Local transaction date MMDD
• DE 41 = 10000005
  terminal ID
• DE 48 = (031) SU20111031102957201110311029573
  notice the 3 digits length field preceding the remaining data in this field. which is a generic (future/private use) field
• DE 70 = 001
  network management information code <001 = sign on>

From DE 70 value 001 this is a sign on message, which must be a 0800 MTI.

To get more information about the location of the MTI and the meaning of DE 48, you should read the manual (technical specs) of this device to get more information.

Answer 2

while sending ISO 8583 message we are converting it in BCD/HEX form ,use Wireshark tool to

track communication between IP and Ports.

Answer 3

A good online bitmap analysis tool is https://neapay.com/online-tools/bitmap-fields-decoder.html.

Sometime helps the https://codebeautify.org/hex-string-converter tool.

For a better understanding of the ISO 8583 message format, it is useful to analyse each field manually. However, each field can have length and value subfields in different formats (BCD, EBCDIC, ASCII ...). And some fields may have inner fields, for example BMP 48 or 60 often used as containers for nested field trees. These inner fields may have tag, length and value. And nested fields of these fields may have different formats again :). For example the https://github.com/credibledoc/credible-doc/blob/master/iso-8583-packer/doc/ebcdic/ebcdic-decimal-tag-packer.md page describes a field with EBCDIC tag and BCD value.

You can use the https://github.com/credibledoc/credible-doc/tree/master/iso-8583-packer Java library (I am the author) for building ISO 8583 messages. The example of ISO message above can be unpacked and packed with the iso-8583-packer library.

Message data:

<f name="Root" lenHex="005B">
    <f name="Header" val="0110000000" valHex="30313130303030303030"/>
    <f name="MTI" val="0820" valHex="30383230"/>
    <f name="Bitmap" bitmapHex="80380000008100000400000000000000" bitSet="{1, 11, 12, 13, 41, 48, 70}">
        <f name="SystemTraceAuditNumber" fieldNum="11" val="362910" valHex="333632393130"/>
        <f name="LocalTransactionTimeHHMMSS" fieldNum="12" val="102957" valHex="313032393537"/>
        <f name="LocalTransactionDateMMDD" fieldNum="13" val="1031" valHex="31303331"/>
        <f name="TerminalId" fieldNum="41" val="10000005" valHex="3130303030303035"/>
        <f name="PrivateData_48" fieldNum="48" val="SU20111031102957201110311029573" lenHex="303331" valHex="53553230...39353733"/>
        <f name="NetworkManagementInformationCode" fieldNum="70" val="001" valHex="303031"/>
    </f>
</f>

Message Structure:

<f type="LEN_VAL" name="Root" lengthPacker="BinaryLengthPacker" bodyPacker="AsciiBodyPacker">
    <f type="VAL" name="Header" bodyPacker="AsciiBodyPacker" len="10"/>
    <f type="VAL" name="MTI" bodyPacker="AsciiBodyPacker" len="4"/>
    <f type="BIT_SET" name="Bitmap" bitMapPacker="IfbBitmapPacker">
        <f type="VAL" fieldNum="11" name="SystemTraceAuditNumber" bodyPacker="AsciiBodyPacker" len="6"/>
        <f type="VAL" fieldNum="12" name="LocalTransactionTimeHHMMSS" bodyPacker="AsciiBodyPacker" len="6"/>
        <f type="VAL" fieldNum="13" name="LocalTransactionDateMMDD" bodyPacker="AsciiBodyPacker" len="4"/>
        <f type="VAL" fieldNum="41" name="TerminalId" bodyPacker="AsciiBodyPacker" len="8"/>
        <f type="LEN_VAL" fieldNum="48" name="PrivateData_48" lengthPacker="AsciiLengthPacker" bodyPacker="AsciiBodyPacker"/>
        <f type="VAL" fieldNum="70" name="NetworkManagementInformationCode" bodyPacker="AsciiBodyPacker" len="3"/>
    </f>
</f>

The example above can be found on GitHub https://github.com/credibledoc/credible-doc/blob/master/iso-8583-packer/src/test/java/com/credibledoc/iso8583packer/examples/UnderstandingIso8583MessageLogTest.java

BMP 55 often contains TLV EMV data. The https://paymentcardtools.com/emv-tlv-parser tool is useful in the case.