Hi, Does Wireshark has a way to display information per LTE user (Data/ VoLTE protocols S1AP, GTPv2, Diameter)? (similar to ISUP VoiP Call analysis option) BR, Diana asked 24 Jun '14, 01:59 Dianalab9 |
One Answer:
It doesn't have a great subscriber trace tool concept, though since you're including VoLTE in that mix it does support some SIP analytics and call breakdowns, mapping SIP to RTP streams, etc. (see the telephony section) For the rest, it supports the protocols but not a call trace. It's not too difficult to write such a trace program though, since you can script it out with a few recursive lookups on packet captures using Wireshark's tshark command utility if it's not built in. For example, trace something like S6a or Ro with:
Each protocol is a little bit different, but most of the recursion logic is at least similar. Diameter is easy in general to trace, as is GTP and GTPv2 (for gtpv2.imsi, take unique sequence numbers, for matching sequence numbers take TEID(s), search for all with those TEIDs), though S1AP/NAS is challenging if you're talking about a need to map out GUTI/S-TMSI procedures to a UE out of a capture file, plus you're more likely to be setting up encryption on authentication with the UE at the NAS layer at least, so you're limited in what Wireshark can see for the Attach, for example. With a fair amount of effort and my passable Perl background I've got a per-protocol tracer that supports just about anything out of the EPC, GPRS or IMS worlds. It's funny you mention ISUP, as that is probably the most challenging due to the nature of CICs and their reuse in multi-streaming Sigtran links. answered 24 Jun '14, 21:33 Quadratic edited 24 Jun '14, 21:35 |