how can i separate voice from text in raw data (GSM captured packets) within a pcap file using wireshark asked 09 Apr '16, 03:35  Maha Salman showing 5 of 8 show 3 more comments |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Are you sure you have captured any voice at all? There is no such thing as "GSM voice packet" as in GSM, voice is carried by TDM channels, not packets. At what kind of equipment do you take your capture, and what is the lowest layer of the frames you capture?
Do you mean GSM frames?
I don't mean anything in particular. He may be capturing MTP frames carrying MAP etc., he may be capturing at A-interface, he may be capturing some Ethernet frames carrying TDM over packet... without the actual capture, it's all just guessing.
we are at UM layer 3 on the interface between BSC and MSC layer, we have these protocols BSSAP and SCCP
Please publish the capture, login-free, somewhere like at cloudshark (preferred), Google drive, MS One Drive... and put a link to it here.
From what you wrote (Um Layer 3, SCCP and above) it still seems you only capture the signalling traffic, not the audio.
Here is my pcap file: https://www.dropbox.com/s/wsoop3zpe201w3r/t2.pcap?dl=0
If I capture the signalling traffic ,How can I extract the audio and text messeges?
This capture contains nothing but network signalling traffic (
Eth->IP->SCTP->Sigtran M3UA->SCCP(->BSSAP(->various application protocols))), so neither voice nor SMSes can be extracted from it.You would have to capture the traffic channels to get to the voice and the dedicated control channels to get to the SMSes.
The fact that you've taken this capture on Ethernet suggests that you might be able to capture the TCH and DCCH on Ethernet as well, but without knowledge of the network it remains only a guess.
And don't forget that GSM transmission is usually ciphered.
Just one more point, there is a flag
1... .... = FI(Full IP): AoIP with compressed speech via RTP/UDP/IP is supported by the BSS/Preferred by the MSCin the codec attributes, so there is a good chance that the voice channels should be available as RTP, but I haven't found any information allowing to correlate a particular RTP stream with the signalling exchange.
But if you are interested in the particular call from 2013 which you've sent as an example, I'm afraid there is nothing more you could do about it unless you have a wider capture from that time.