This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to filter GSM messages in Wireshark?

0

In my Wireshark Network traffic I get both 2G and 3G data packets (gsm_map). How to filter only 2g or only 3g data packets?

We usually concern about AnyTimeInterrogation message in GSM.

asked 23 Oct '13, 05:43

pranitkothari's gravatar image

pranitkothari
51●5●6●10
accept rate: 100%

3 Answers:

0

I found answer myself.

In display filter, I need to use,

gsm_map.ms.sai_Present

answered 23 Oct '13, 23:53

pranitkothari's gravatar image

pranitkothari
51●5●6●10
accept rate: 100%

1

It might be possible to filter on AnyTimeInterrogationRes and values in SubscriberInfo like lastRAT-Type but the element is Optional so I'm not sure.

answered 23 Oct '13, 08:02

Anders's gravatar image

Anders ♦
4.6k●9●52
accept rate: 17%

I got good hint from your answer. Final answer I have posted to my question. Thanks.

(24 Oct '13, 00:41) pranitkothari

1

Pranitkothari, just make sure that you don't run into cases where the subscriber is reachable by UMTS but the SAI is not included in the ATI return. A few things to note about your approach here:

  • ATI/PSIR call flow will at best return the last-known subscriber location. A paging procedure will not be triggered by VMSC just to return a PSIR.
  • VMSC does not need to return an SAI. It's optional and is potentially subject to vendor-proprietary logic. For example, an operator may not want SAI-level precision to be available to anything that interrogates their HLR.
  • Consider the case of CS Fallback, if your network includes EUTRAN radio access as well as the UMTS cells you're trying to filter for. In that case, a UE can be available in an SAI (by virtue of VMSC -> MME page procedure with a release with redirect back to UMTS), but an SAI could not be returned in ATI query since the subscriber last registered via an ECGI, not an SAI (in which case, at best, last-known location from the perspective of VMSC/HLR would be at the LAI-level).

Those items might sound like paranoia if you're literally just looking for ATI responsees where the location returned was in UMTS coverage, but depending on your network environment that it's possible to be available in UMTS but not have an SAI included in ATI response to the interrogator. The solution may work for you depending on your case though.

answered 24 Oct '13, 17:55

Quadratic's gravatar image

Quadratic
1.9k●6●9●28
accept rate: 13%

edited 24 Oct '13, 17:58

@Quadratic: We are dealing with location related services, and it is ensured from our vendor that we will get SAI in UMTS packet if we request for ATI.

You really seems to have good in-depth knowledge of GMS/UMTS. We work in location related services, can you please suggest good reference material and forum for GSM and UMTS?

(24 Oct '13, 23:32) pranitkothari

I asked the same question when I started in the mobile space. It's unfortunate, but the best resource out there I've ever been able to find has been the 3GPP whitepapers, with the second best probably being the paid training services of groups like Award Solutions. There's some youtube stuff out there but most is just intro and none that I've seen are very real-world.

Aside from a lack of strong open training resources out there, there's also no real authority to point to for certifications to validate knowledge in mobile signaling theory, and from that there's a lack of a single sylabus and knowledge base to develop training materials around. For lack of a better analogy, there is no "CCNA of mobile wireless signaling" for everyone to turn to, no way to ask for that validation in an interview, and for those who want to learn you're largely faced with reading the 3GPP whitepapers and RFCs.

Now, I don't consider myself a very effective teacher most of the time, since I have a hard time considering where the audience is coming from and they get lost in my analogies a lot, but I am trying to do something about this problem. I'm not focused on the UMTS side at the moment, but for the evolved packet core I am trying to complete a decent video series on everything from base call flows to mobility management to policy and credit control. It's been hard to find all the time to get it done on my own time, and another big difficulty is that I'm trying to make it very real-world but NDA agreements prevent most real-world examples or stories I could give, and it's very hard to find packet captures that could be used for that kind of training video exercise which wouldn't be barred by NDAs as well.

(25 Oct '13, 17:48) Quadratic