Help with Huawei tmf files

[nale]

Hi All, I want to develop own tool to open and interpret Huawei trace files (*.tmf) so I need the tmf description/specification in order to do this.

Specifically we need the IOS Tracing description and UMTS Huawei CDT CELL and IMSI traces RAN10/RAN11 binary formats (*.tmf files) descriptions.

Does anyone have this information or from where I can get it?

If there is a tool to convert tmf files to simple flat text file, it will help also, in that case we can load the simpler txt file instead of loading the tmf.

Thanks in advance.

[arjaypanganiban]

Hi,

.tmf files can be saved in txt format directly. However for the binary equivalent of the messages in the .tmf file, It cannot be done directly but I think it can be calculated since every message has a Hexadecimal equivalent.

[jhowkins]

Hello Nale,

I too am working on achieving this feat.

Here is what I can tell you right now.

UMTS Signalling abides by 3GPP standards. You will find that all messages shall use ASN.1 Basic Packed Encoding Rules (BASIC-PER) Aligned Variant as transfer syntax. ASN definitions are required to understand these messages, and can be found within each respective technical specification (TS) document available from ETSI / 3GPP.

In addition to this, you can also find more detailed information about the specific variation of ASN.1 3GPP uses (X.680) - You can download this spec here: http://www.itu.int/rec/T-REC-X.680-200811-I/en
(http://www.itu.int/rec/T-REC-X.680-200811-I/en)
Finally, Huawei themselves appear to use their own definition of ASN.1 for a header which includes such things as CHR Ver (ie. V900R012....), Username (ie. user logged-in that requested the trace), IP address, language, Message Type, Trace Type, etc. The header proceeds the actual content of the file which contains the information we're all looking to parse.

It's all very dynamic, but can be hard coded if you're looking only for specific parameters. You will need to know where in the message to look for length tags to traverse the message to the correct location of whatever it is that you want to find. The decimal equivalent of the 2-octet hex length tag will tell you how many octets (bytes) that container will be. The beginning of all messages start with 6d 73 67 30 (MSG0) which makes it relatively easy to find the starting point of where to start looking. Excluding the first 4 octets of the message (MSG0), the 3rd and 4th octet contain the message length. (ie. 01 08 = 264 ; the message container is 264 octets long)

Good luck!

Please let me know if you have any success reversing the Huawei header. I have most of it figured out, but the first 4 octets still have me stumped!

[jhowkins]

In addition to my last post, I've discovered that each PDU (Protocol Data Unit) or simply, the raw data contained within each message is proceeded after a Huawei message header (not to be confused with the header at the beginning of the file). Each message header contains the following info; Message Number, Date/Time, Trace Type, Direction, Message Source, Message Type, Subrack/Slot/Subsystem, Option, RFN, etc.

The file header AND each message header can be variable depending on a number of things, so one way or another you must find a way to locate the beginning of the actual PDU. If you have access to several different types of .tmf trace files for various message types, it shouldn't be too difficult to determine where to locate the length tags in the message header and determine to find the start of the PDU.

[jhowkins]

I might be wrong on the header being Huawei proprietary. Further reading has revealed a potential avenue for further investigation. A few good places to start... Read ETSI/ 3GPP TS 22.078, 23.078, 29.078

Also read about Signalling System 7 (SS7) or more specifically about some SS7 protocols... MTP (Message Transfer Part), SCCP (Signalling Connection Control Part), TCAP (Transaction Capabilities Application Part) & CAP (CAMEL Application Part)

It appears the .tmf file is a combination of these protocols. Each contained within the next.

Example: [ MTP Message [ SCCP Message [ TCAP Message [ CAP Message ] ] ]

I'd be interested to hear if anyone else is working on this.

[tecnofull]

Hello everybody, I am sharing with you this tool.... UMAT, but, i haven't any information about the HELP. Please, let my know if you could get any something help, guidelines.
The program once installed remains resident in windows services.
So, you need open (*.tmf) file with mouse's rigth button and others such files that are coming from huawei RNC, BSC, etc. like *txt files.

Regards

[jimjim]

Hello there,

I hope this could be helpful for people looking siganlling analysis for Huawei RAN.

Regards,

26380

[ventinel]

hi, can u plz share for 2G also???

Hello there,

I hope this could be helpful for people looking siganlling analysis for Huawei RAN.

Regards,

26380

[auto_art]

Dear all


I have already shared tool to convert .tmf files to ma10 compatible format (forget extention).
Ma10 is very easy to use to analyse call trace. Browse through my earlier threads or search using tags tmf converter and ma10.

Sent from my GT-I9100