Parser for E******* LTE UETR/CTR

**snabeel03** · 2012-01-13, 01:00 AM

Hello,

Any idea/pointers to use any existing parser for E******* LTE UETR/CTR?
Or,guidelines how to write one's own parser for these recordings?

**Finetopix** · 2012-01-13 01:00 AM

**s52d** · 2012-01-14, 01:23 AM

Originally Posted by snabeel03

Hello,

Any idea/pointers to use any existing parser for E******* LTE UETR/CTR?
Or,guidelines how to write one's own parser for these recordings?

Hi!
Check Alex: file format is quite well described, with .xls files ready for coders.
It is much simpler as UTRAN one, so I reccomend you make new one based on UTRAN.
For s1/x2/rrc you need decent asn.1 parser: Wireshark migh to well.

Good luck,
s52d

**striker** · 2012-01-14, 11:14 AM

I think parser for that one is statics...share your file will try to check.

**s52d** · 2012-12-14, 05:46 AM

Hello!

I am trying to use latest wireshark to decode LTE protocols data embedded in CTR. It works for S1 (going to hex, then tex2pcap, then tshark -V).

But, something is lost with RRC, I can not get it running:

Maybe I should add something to RRC, like direction?

Best regards, thanks, HNY

s52d

example in hex, RC_CONNECTION_REQUEST
000000 58 55 95 97 74 06 zz

tshark answer:
Frame 1: 6 bytes on wire (48 bits), 6 bytes captured (48 bits)
WTAP_ENCAP: 54
Arrival Time: Dec 13, 2012 21:35:02.000000000 CET
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1355430902.000000000 seconds
[Time delta from previous captured frame: .000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 6 bytes (48 bits)
Capture Length: 6 bytes (48 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: user_dlt:rlc-lte]
DLT: 156, Payload: rlc-lte (RLC-LTE)
RLC-LTE
[Can't dissect LTE RLC frame because no per-frame info was attached!]

S1 example:
hex:
000000 20 17 00 12 00 00 02 00 00 40 05 C0 01 36 FC D2 00 08 40 02 00 68 zz

tshark:
Frame 15: 22 bytes on wire (176 bits), 22 bytes captured (176 bits)
WTAP_ENCAP: 56
Arrival Time: Dec 13, 2012 21:37:55.000014000 CET
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1355431075.000014000 seconds
[Time delta from previous captured frame: 0.000001000 seconds]
[Time delta from previous displayed frame: 0.000001000 seconds]
[Time since reference or first frame: 0.000014000 seconds]
Frame Number: 15
Frame Length: 22 bytes (176 bits)
Capture Length: 22 bytes (176 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: user_dlt:s1ap:s1ap:s1ap:s1ap]
DLT: 158, Payload: s1ap (S1 Application Protocol)
S1 Application Protocol
S1AP-PDU: successfulOutcome (1)
successfulOutcome
procedureCode: id-UEContextRelease (23)
criticality: reject (0)
value
UEContextReleaseComplete
protocolIEs: 2 items
Item 0: id-MME-UE-S1AP-ID
ProtocolIE-Field
id: id-MME-UE-S1AP-ID (0)
criticality: ignore (1)
value
MME-UE-S1AP-ID: 20380882
Item 1: id-eNB-UE-S1AP-ID
ProtocolIE-Field
id: id-eNB-UE-S1AP-ID (8)
criticality: ignore (1)
value
ENB-UE-S1AP-ID: 104

**Pankajgoyal38** · 2013-03-23, 06:53 PM

Hello Guys,

Yaar Actually I am also working on same thing. I want to decode S1AP. I tried to use wireshark code for asn1c/s1ap. But I am getting compilation error in :-

S1AP-IEs.asn and S1AP-PDU-Description.asn

Please Help me. You have done it, help me to do this, Please.

How to use wireshark to decode it and how to print it at console.

Thanks

Regards
Pankaj Singh

**s52d** · 2013-03-23, 08:24 PM

Hello!

from CTR parser we generate hex files, one protocol message per file.
with text2pcap we get pcap files, and then decode with tshark,

for s1:
/usr/local/bin/text2pcap -q -l 148 b.1 b1.pcap #s1
/usr/local/bin/tshark -r b1.pcap -V | sed "s/ / /g" >b1.txt

you need proper user_dlts file:

:~/lte$ cat ~/.wireshark/user_dlts
# This file is automatically generated, DO NOT MODIFY.
#Valid user link-layer header type values are in the range 147 - 162 (USER0 - USER15)
"User 0 (DLT=147)","nas-eps","0","","0",""
"User 1 (DLT=148)","s1ap","0","","0",""
"User 2 (DLT=149)","x2ap","0","","0",""
"User 3 (DLT=150)","lte-rrc.bcch.bch","0","","0",""
"User 4 (DLT=151)","lte-rrc.bcch.dl.sch","0","","0",""
"User 5 (DLT=152)","lte-rrc.dl.ccch","0","","0",""
"User 6 (DLT=153)","lte-rrc.dl.dcch","0","","0",""
"User 7 (DLT=154)","lte-rrc.pcch","0","","0",""
"User 8 (DLT=155)","lte-rrc.ul.ccch","0","","0",""
"User 9 (DLT=156)","lte-rrc.ul.dcch","0","","0",""
"User 10 (DLT=157)","rrc.ul.dcch","0","","0",""
"User 11 (DLT=158)","rrc.ul.ccch","0","","0",""
"User 12 (DLT=159)","rrc.dl.dcch","0","","0",""
"User 13 (DLT=160)","rrc.dl.ccch","0","","0",""
"User 14 (DLT=161)","ranap","0","","0",""
"User 15 (DLT=162)","nbap","0","","0",""

br
s52d

**a19997104** · 2014-02-06, 03:20 AM

any idea how to interpretate this? (please see attached picture)

UE_CAP_FGI_BITMAP {0,127,15,254}
i know its UE capability feature group indictor group map, and its a 32 bit string, but {0,127,15,254} ?? , i thought it was converting from decimal to BIN, but seems that is not like that..