Project

General

Profile

WiresharkIntegration » History » Version 7

Anonymous, 02/19/2016 10:49 PM
Requires >1.4.0 to have GSMTAP build in.

1 1 laforge
= Wireshark integration =
2
3 5 laforge
[http://www.wireshark.org/ wireshark] is a popular Free Software / Open Source protocol analyzer.  Among many
4
other protocols, it includes dissectors for the GSM Layer 2 (TS 04.06 / LAPDm) and 3 (TS 04.8 04.08 / RR,MM,CC).
5 1 laforge
6 4 laforge
There also is a [wiki:GSMTAP] protocol dissector in recent wireshark versions, which allows
7
real-time capture and decode of GSM protocol messages encapsulated in a GSMTAP (pseudo-header,
8
which is in turn encapsulated in UDP and IP).
9 1 laforge
10 7 laforge
So if you have a wireshark version with [wiki:GSMTAP] support (>1.4.0), you can have real-time decode and
11 6 tsaitgaist
trace of GSM protocol messages. You can also [wiki:wireshark compile wireshark] yourself.
12 1 laforge
13 4 laforge
The OsmocomBB [wiki:layer23] program sends [wiki:GSMTAP] packets to the localhost (127.0.0.1) address
14
of the loopback interface (lo).  Please note that the wireshark program is doing passive capture,
15
i.e. if nothing is listening on the [wiki:GSMTAP] UDP port (4729), then you will see ICMP port unreachable
16
messages in addition to the GSMTAP messages.  There are two suggested solutions to this:
17
 * Change the IP address to a multicast group like 224.0.0.1 (instead of 127.0.0.1)
18
 * Run some program that simply opens the UDP port and discards its content, e.g. using {{{{nc -u -l -p 4729 > /dev/null}}}
19 2 laforge
20
== Screenshot ==
21
22
[[Image(gsmtap-wireshark.png, 66%)]]
Add picture from clipboard (Maximum size: 48.8 MB)