This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

information per LTE user

0

Hi,

Does Wireshark has a way to display information per LTE user (Data/ VoLTE protocols S1AP, GTPv2, Diameter)? (similar to ISUP VoiP Call analysis option)

BR, Diana

asked 24 Jun '14, 01:59

Dianalab9's gravatar image

Dianalab9
26161620
accept rate: 0%


One Answer:

0

It doesn't have a great subscriber trace tool concept, though since you're including VoLTE in that mix it does support some SIP analytics and call breakdowns, mapping SIP to RTP streams, etc. (see the telephony section) For the rest, it supports the protocols but not a call trace.

It's not too difficult to write such a trace program though, since you can script it out with a few recursive lookups on packet captures using Wireshark's tshark command utility if it's not built in.

For example, trace something like S6a or Ro with:

tshark -r {file} -R diameter.User-Name=={imsi} -T fields -e diameter.Session-Id
tshark -r {file} -R diameter.Session-Id=={list of all unique IDs returned in the above command}

Each protocol is a little bit different, but most of the recursion logic is at least similar. Diameter is easy in general to trace, as is GTP and GTPv2 (for gtpv2.imsi, take unique sequence numbers, for matching sequence numbers take TEID(s), search for all with those TEIDs), though S1AP/NAS is challenging if you're talking about a need to map out GUTI/S-TMSI procedures to a UE out of a capture file, plus you're more likely to be setting up encryption on authentication with the UE at the NAS layer at least, so you're limited in what Wireshark can see for the Attach, for example.

With a fair amount of effort and my passable Perl background I've got a per-protocol tracer that supports just about anything out of the EPC, GPRS or IMS worlds. It's funny you mention ISUP, as that is probably the most challenging due to the nature of CICs and their reuse in multi-streaming Sigtran links.

answered 24 Jun '14, 21:33

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 24 Jun '14, 21:35