Hi I would like to know , how can we filtered out all related traces of a particular request on a production system. For example , in a telecom network , how can we filtered out all related data for a particular IMSI ? Regards Luke. asked 14 Feb '15, 20:31 luke_devon |
One Answer:
There isn't anything as simple as that, but on a per-protocol basis it can certainly be done. For example:
And I could keep going. :) My point here is that your tracing methodology will depend greatly on the protocol, especially if you want all signaling that relates to a subscriber rather than just messages that contain the IMSI verbatim. Now, in a telecom context typically you have trace tools (eg: Tektronix) to do this, though depending on what you're trying to do it isn't impossible to just built these trace tools from scratch. It's definitely not built into wireshark proper, though. answered 15 Feb '15, 12:35 Quadratic edited 15 Feb '15, 12:37 Well, the development version of Wireshark (1.99.x) should make this easier: a lot of the places where Wireshark finds an IMSI (e.g., diameter.User-Name for S6a/S6d) now has a non-protocol-specific filter: e212.imsi . SCCP is the same (if the NP is appropriate). I forget what other protocols have been converted but I'm pretty sure Anders did a bunch. (15 Feb '15, 15:25) JeffMorriss ♦ |
If it is GSM_MAP, you'd use as a display filter "gsm_map.imsi_digits contains 123456789012345" or some partial IMSI thereof. In newer versions of Wireshark, it's "gsm_map.imsi"
What Quadratic said is right about SS7 applications. In an ANSI network, there will be an E212/IMSI in the SCCP called party address for messaging that is being routed to a mobile global title (UpdateLocation, SendAuthenticationInfo, etc). In an ITU network, instead of E212/IMSI it will be a hybrid E214 for those same messages types. Note that for supplementary services type messages (i.e. hen a user sends *129# for balance inquiry) the IMSI is actually in the TCAP layer as a "destination reference".
If you give more specifics we can probably help you more.