Scribd Logo
Upload

Welcome to Scribd!

  • 301 views

    Wireshark Filter For Lte PDF

    Uploaded by

    Anonymous X6iPKl
    This document provides instructions for creating Wireshark filters to analyze an end-to-end LTE call using an IMSI number as the key input. It outlines filters for NAS, S1-AP, S6a, S13, GTPv2, Gx and SGsAP interfaces to extract messages associated with the call. The final filter combines criteria for various interfaces to filter all LTE-related messages using the IMSI, ENB ID, diameter IDs or message codes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Wireshark Filter For Lte PDF

    Uploaded by

    Anonymous X6iPKl
    301 views3 pages
    This document provides instructions for creating Wireshark filters to analyze an end-to-end LTE call using an IMSI number as the key input. It outlines filters for NAS, S1-AP, S6a, S13, GTPv2, Gx and SGsAP interfaces to extract messages associated with the call. The final filter combines criteria for various interfaces to filter all LTE-related messages using the IMSI, ENB ID, diameter IDs or message codes.

    Original Title

    Wireshark Filter for Lte .pdf

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides instructions for creating Wireshark filters to analyze an end-to-end LTE call using an IMSI number as the key input. It outlines filters for NAS, S1-AP, S6a, S13, GTPv2, Gx and SGsAP interfaces to extract messages associated with the call. The final filter combines criteria for various interfaces to filter all LTE-related messages using the IMSI, ENB ID, diameter IDs or message codes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    301 views3 pages

    Wireshark Filter For Lte PDF

    Uploaded by

    Anonymous X6iPKl
    This document provides instructions for creating Wireshark filters to analyze an end-to-end LTE call using an IMSI number as the key input. It outlines filters for NAS, S1-AP, S6a, S13, GTPv2, Gx and SGsAP interfaces to extract messages associated with the call. The final filter combines criteria for various interfaces to filter all LTE-related messages using the IMSI, ENB ID, diameter IDs or message codes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 3

    Wireshark Filter for Lte.

    txt

    To Find out single end to end LTE call Flow from multiple
    wireshark Capture trace,Please follow the below sequential
    steps:Only input we required to make the fillter is IMSI
    404909060013311.NAS and S1-AP message in between UE-MME,
    eND-MME (NAS,
    S1-AP)-----------------------------------------------------
    ----------nas_eps.emm.imsi == "404909060013311" //with this
    filter, we are able to extract InitialUEMessage,
    AttachRequest, PDNConnectivity Request.From above output
    try to get s1ap.ENB_UE_S1AP_ID == 607 // which gives you
    allthe meesages on S1-AP, NAS-EPS
    message.s1ap.ENB_UE_S1AP_ID == 607Diameter Message in
    between MME to HSS (S6a and
    S13)--------------------------------------------We can
    easily put fillter as usernamediameter.User-Name ==
    "404909060013311" // Result of this Filter gives us the
    output as AIR, ME-Identity Check and ULR from MME to
    HSS.Now our aim should be find the response for each
    corresponding Request.diameter.hopbyhopid == 0x57539708 //
    look for the fillter as Hop by Hopidentifier on AIR
    messagediameter.User-Name ==
    "404909060013311"||diameter.hopbyhopid ==0x57539708 // Now
    we are able to get AIR, ME-Identity Check, ULR and AIAnext
    Pending Message id ME-Identity Check Response
    diameter.hopbyhopid == 0x219bbd08only pending message is
    ULA, for that we need to extract the fillter from
    Hop-by-Hop of ULR message (diameter.hopbyhopid ==
    0x78267708).diameter.User-Name ==
    "404909060013311"||diameter.hopbyhopid
    ==0x57539708||diameter.hopbyhopid ==
    0x219bbd08||diameter.hopbyhopid == 0x78267708//Gives us all
    the message in s6a interfacesorWe can easily put fillter as
    usernamediameter.User-Name == "404909060013311" // Result
    of this Filter gives us the output as AIR, ME-Identity
    Check and ULR from MME to HSS.diameter.Session-Id ==
    "mme01.e2elte.ril.in;44527db4;772a0b5f;041cda8a"for AIR and
    AIAdiameter.Session-Id ==
    "mme01.e2elte.ril.in;44527db4;772a0b5f;39b9f14a"for ULR and
    ULAdiameter.Session-Id ==
    "mscp01.pgw2.e2elte.ril.in;1695a065;4de4beb8;40409000000001
    Pge p
    Wireshark Filter for Lte.txt
    0-00a00100" all the message in between in PGW and PCR

    Diameter Message in between PCRF and


    P-CSCF-------------------------------------------(diameter.
    Session-Id == "Video_Streaming2") ||
    (diameter.Framed-IP-Address.IPv4== 10.21.1.1) //message in
    between Rx Interface !!GTPv2 messages in between MME to SGW
    (S11), SGW to PGW
    (S5/S8)----------------------------------------------------
    -----------Steps to filter out the CSR, CSResp, from MME to
    SGW, SGW to PGWFirst figure out gtpv2.imsi ==
    "404909060013311" // result give us CSR from MME to SGW,
    SGW to PGW.Then Extract EPS Bearer ID which is unique among
    this gtpv2.ebi == 5, which gives us all the message on
    GTPv2 header from MME to SGW, SGW to PGW.Now update fillter
    isgtpv2.imsi == "404909060013311" ||gtpv2.ebi == 5 // for
    all themessages in between , MME, SGW, and PGW on GTPv2
    Interfaces.Diameter message in between PGW to PCRF
    (Gx).----------------------------------------------diameter
    .Subscription-Id-Data == "404909060013311" this filter
    result give you the CCR message, but not the CCResponse for
    this.But with help of this filter we can figure out
    diameter.hopbyhopid , asa result we can able to find out
    the CCResp messagediameter.hopbyhopid == 0x03d86c6aNow
    updated filter for Diameter message in between PGW to PCRF
    is as belows:diameter.Subscription-Id-Data ==
    "404909060013311"||diameter.hopbyhopid== 0x03d86c6aNow
    below filter gives us the result for Both GTPv2 messages in
    betweenMME to SGW, SGW to PGW and Diameter message in
    between PGW to PCRF (S11, S5/S8,Gx)gtpv2.imsi ==
    "404909060013311"||gtpv2.ebi ==
    5||diameter.Subscription-Id-Data ==
    "404909060013311"||diameter.hopbyhopid == 0x03d86c6aSGsAP
    Message in between MME to MSC
    (SGs)--------------------------------------gsm_a.imsi ==
    "404909060013311"So final filter is as
    below((s1ap||x2ap||sgsap||gtpv2||sip||diameter)&&!(diameter
    .cmd.code == 280)) // forFilltering out all the message who
    belongs to only LTE based massages (S1-AP, NAS-EPS,
    GTPv2,Diameter and SGS Interface

    nas_eps.emm.imsi == "404909060013311"||s1ap.ENB_UE_S1AP_ID
    Pge p
    Wireshark Filter for Lte.txt
    == 607||gsm_a.imsi =="404909060013311"||diameter.User-Name
    == "404909060013311"||diameter.hopbyhopid==
    0x57539708||diameter.hopbyhopid ==
    0x219bbd08||diameter.hopbyhopid == 0x78267708||gtpv2.imsi
    == "404909060013311" ||gtpv2.ebi ==
    5||diameter.Subscription-Id-Data ==
    "404909060013311"||diameter.hopbyhopid ==
    0x03d86c6as1ap.ENB_UE_S1AP_ID == 607||diameter.hopbyhopid
    == 0x57539708||diameter.hopbyhopid ==
    0x219bbd08||diameter.hopbyhopid == 0x78267708||gsm_a.imsi
    == "404909060013311"

    Pge p

    You might also like