Project

General

Profile

Actions

WiresharkIntegration » History » Revision 10

« Previous | Revision 10/11 (diff) | Next »
laforge, 02/21/2016 10:12 AM


Wireshark integration

wireshark is a popular Free Software / Open Source protocol analyzer. Among many
other protocols, it includes dissectors for the GSM Layer 2 (TS 04.06 / LAPDm) and 3 (TS 04.8 04.08 / RR,MM,CC).

There also is a GSMTAP protocol dissector in recent wireshark versions, which allows
real-time capture and decode of GSM protocol messages encapsulated in a GSMTAP (pseudo-header,
which is in turn encapsulated in UDP and IP).

So if you have a wireshark version with GSMTAP support (>1.4.0), you can have real-time decode and
trace of GSM protocol messages. You can also compile wireshark yourself.

The OsmocomBB layer23 program sends GSMTAP packets to the localhost (127.0.0.1) address
of the loopback interface (lo). Please note that the wireshark program is doing passive capture,
i.e. if nothing is listening on the GSMTAP UDP port (4729), then you will see ICMP port unreachable
messages in addition to the GSMTAP messages. There are two suggested solutions to this:
  • Change the IP address to a multicast group like 224.0.0.1 (instead of 127.0.0.1)
  • Run some program that simply opens the UDP port and discards its content, e.g. using nc -u -l -p 4729 > /dev/null

Screenshot

screenshot of wireshark with gsmtap capture

Files (4)
gsmtap-arfcn25-cccb.pcap gsmtap-arfcn25-cccb.pcap 31.7 KB pcap file with GSMTAP data of BCCH received on ARFCN 25 in Berlin Marienstr. 11 laforge, 02/19/2010 10:23 PM
gsmtap-wireshark.png View gsmtap-wireshark.png 122 KB screenshot of wireshark with gsmtap capture laforge, 02/19/2010 10:29 PM
wireshark-layer23-lapdm.png View wireshark-layer23-lapdm.png 148 KB screenshot of wireshark protocol decode of LAPDm LOC UPD REQ laforge, 03/04/2010 02:54 PM
layer23-lapdm-gsmtap.pcap layer23-lapdm-gsmtap.pcap 4.76 KB pcap file generated by layer23 showing BCCH/CCCH info, IMM ASS, LOC UPD REQ and LOC UPD REJ laforge, 03/04/2010 08:55 PM

Updated by laforge about 8 years ago · 10 revisions

Add picture from clipboard (Maximum size: 48.8 MB)