I want to decode MAC-LTE message but when I try to decode using tshark it gives the following error. Can't dissect LTE MAC frame because no per-frame info was attached! asked 04 Apr '12, 03:01  ender |
One Answer:
The MAC-LTE dissector needs certain context information to be attached to the frame before it can knows how to properly dissect it. There is the mac-lte-framed dissector. It currently doesn't have its own DLT, so I've used it with one of the user DLTs (e.g. 147). It still needs to have the context information, which is stored in the same format as the supported MAC-over-UDP format (minus the identifying string that the UDP format uses). You would then need to associate your DLT with the protocol 'mac-lte-framed'. I could post sample code for for writing to this file format to the wiki, if that would help. You could use mac-lte-framed, or invent your own format, but you'll still need to attach the context info to each frame ( get_mac_lte_proto_data() and set_mac_lte_proto_data() are available for this and could be called from a plugin if necessary ). answered 05 Apr '12, 05:37  MartinM (I wanted to edit my comment to note that you would edit the preferences of the USER_DLT dissector to associated mac-lte-framed with a DLT, but couldn't work out how to save my edit...) (05 Apr '12, 05:43) MartinM If you have edit privs, then it's the little diagonal pen icon next to your name in the comment. (05 Apr '12, 07:02) grahamb ♦ @MartinM I would appreciate if you could post sample code. (05 Apr '12, 09:35) ender 1 OK, I uploaded sample code, which should be available here: http://www.wireshark.org/~martinm/mac_pcap_sample_code.c I will update http://wiki.wireshark.org/MAC-LTE later today with a link to it. (06 Apr '12, 09:02) MartinM @MartinM I compiled sample code and run it. it created "test1.pcap" file. But when I open it in wireshark, it says "Can't dissect LTE MAC frame because no per-frame info was attached!". Did I miss some steps? (I tested on wireshark 1.7.1-SVN-41918) (09 Apr '12, 03:29) ender Did you configure USER_DLT to use 'mac-lte-framed' rather than 'mac-lte' as the payload protocol? Also you need a pretty recent version of Wireshark, e.g. recent sources, a development snapshot or 1.7.1. If both of these are OK, you could send me your test1.pcap to make sure it is the same as the output I get. (09 Apr '12, 03:43) MartinM Changing USER_DLT to 'mac-lte-framed' solved my problem. @MartinM, thanks for your help. (09 Apr '12, 04:52) ender showing 5 of 7 show 2 more comments |
How are the LTE frames stored in the file? Is this a Catapult DCT2000 file (text file), or is it a capture with LTE MAC-over-UDP, or is it something else?
Unfortunately it is not neither Catapult file nor MAC-over-UDP. It is a just a MAC message without any frames.