Project

General

Profile

Actions

WiresharkIntegration » History » Revision 6

« Previous | Revision 6/11 (diff) | Next »
tsaitgaist, 02/19/2016 10:49 PM
add link to compile wireshark


= Wireshark integration =

[http://www.wireshark.org/ wireshark] is a popular Free Software / Open Source protocol analyzer. Among many
other protocols, it includes dissectors for the GSM Layer 2 (TS 04.06 / LAPDm) and 3 (TS 04.8 04.08 / RR,MM,CC).

There also is a [wiki:GSMTAP] protocol dissector in recent wireshark versions, which allows
real-time capture and decode of GSM protocol messages encapsulated in a GSMTAP (pseudo-header,
which is in turn encapsulated in UDP and IP).

So if you have a wireshark version with [wiki:GSMTAP] support, you can have real-time decode and
trace of GSM protocol messages. You can also [wiki:wireshark compile wireshark] yourself.

The OsmocomBB [wiki:layer23] program sends [wiki:GSMTAP] packets to the localhost (127.0.0.1) address
of the loopback interface (lo). Please note that the wireshark program is doing passive capture,
i.e. if nothing is listening on the [wiki:GSMTAP] UDP port (4729), then you will see ICMP port unreachable
messages in addition to the GSMTAP messages. There are two suggested solutions to this: * Change the IP address to a multicast group like 224.0.0.1 (instead of 127.0.0.1) * Run some program that simply opens the UDP port and discards its content, e.g. using {{{{nc -u -l -p 4729 > /dev/null}}}

Screenshot

Image(gsmtap-wireshark.png, 66%)

Files (4)
gsmtap-arfcn25-cccb.pcap gsmtap-arfcn25-cccb.pcap 31.7 KB pcap file with GSMTAP data of BCCH received on ARFCN 25 in Berlin Marienstr. 11 laforge, 02/19/2010 10:23 PM
gsmtap-wireshark.png View gsmtap-wireshark.png 122 KB screenshot of wireshark with gsmtap capture laforge, 02/19/2010 10:29 PM
wireshark-layer23-lapdm.png View wireshark-layer23-lapdm.png 148 KB screenshot of wireshark protocol decode of LAPDm LOC UPD REQ laforge, 03/04/2010 02:54 PM
layer23-lapdm-gsmtap.pcap layer23-lapdm-gsmtap.pcap 4.76 KB pcap file generated by layer23 showing BCCH/CCCH info, IMM ASS, LOC UPD REQ and LOC UPD REJ laforge, 03/04/2010 08:55 PM

Updated by tsaitgaist about 8 years ago · 6 revisions

Add picture from clipboard (Maximum size: 48.8 MB)