This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to decode MAC-LTE message?

0

I want to decode MAC-LTE message but when I try to decode using tshark it gives the following error. Can't dissect LTE MAC frame because no per-frame info was attached!

asked 04 Apr '12, 03:01

ender's gravatar image

ender
6114
accept rate: 0%

How are the LTE frames stored in the file? Is this a Catapult DCT2000 file (text file), or is it a capture with LTE MAC-over-UDP, or is it something else?

(04 Apr '12, 14:46) Guy Harris ♦♦

Unfortunately it is not neither Catapult file nor MAC-over-UDP. It is a just a MAC message without any frames.

(05 Apr '12, 03:09) ender

One Answer:

1

The MAC-LTE dissector needs certain context information to be attached to the frame before it can knows how to properly dissect it.

There is the mac-lte-framed dissector. It currently doesn't have its own DLT, so I've used it with one of the user DLTs (e.g. 147). It still needs to have the context information, which is stored in the same format as the supported MAC-over-UDP format (minus the identifying string that the UDP format uses). You would then need to associate your DLT with the protocol 'mac-lte-framed'. I could post sample code for for writing to this file format to the wiki, if that would help.

You could use mac-lte-framed, or invent your own format, but you'll still need to attach the context info to each frame ( get_mac_lte_proto_data() and set_mac_lte_proto_data() are available for this and could be called from a plugin if necessary ).

answered 05 Apr '12, 05:37

MartinM's gravatar image

MartinM
16717
accept rate: 33%

(I wanted to edit my comment to note that you would edit the preferences of the USER_DLT dissector to associated mac-lte-framed with a DLT, but couldn't work out how to save my edit...)

(05 Apr '12, 05:43) MartinM

If you have edit privs, then it's the little diagonal pen icon next to your name in the comment.

(05 Apr '12, 07:02) grahamb ♦

@MartinM I would appreciate if you could post sample code.

(05 Apr '12, 09:35) ender
1

OK, I uploaded sample code, which should be available here: http://www.wireshark.org/~martinm/mac_pcap_sample_code.c I will update http://wiki.wireshark.org/MAC-LTE later today with a link to it.

(06 Apr '12, 09:02) MartinM

@MartinM I compiled sample code and run it. it created "test1.pcap" file. But when I open it in wireshark, it says "Can't dissect LTE MAC frame because no per-frame info was attached!". Did I miss some steps? (I tested on wireshark 1.7.1-SVN-41918)

(09 Apr '12, 03:29) ender

Did you configure USER_DLT to use 'mac-lte-framed' rather than 'mac-lte' as the payload protocol? Also you need a pretty recent version of Wireshark, e.g. recent sources, a development snapshot or 1.7.1.

If both of these are OK, you could send me your test1.pcap to make sure it is the same as the output I get.

(09 Apr '12, 03:43) MartinM

Changing USER_DLT to 'mac-lte-framed' solved my problem. @MartinM, thanks for your help.

(09 Apr '12, 04:52) ender
showing 5 of 7 show 2 more comments