ProtocolTracing » History » Version 4
laforge, 02/19/2016 10:47 PM
rename bsc_hack to osmo-nitb in page text
1 | 2 | laforge | = PCAP and protocol analysis = |
---|---|---|---|
2 | |||
3 | pcap is a data format for captured packets of communication protocols. It is used by a library called libpcap, which in turn is |
||
4 | used by popular network protocol analyzer projects such as tcpdump and wireshark. |
||
5 | |||
6 | In the Ethernet/Internet world, you typically capture packets from your ethernet card using RAW sockets and promiscuous mode. |
||
7 | |||
8 | With GSM protocols such as A-bis, it is obviously not that simple - since they are at least traditionally not transported over IP. |
||
9 | |||
10 | 1 | = Recording and viewing A-bis communication = |
|
11 | |||
12 | == Recording == |
||
13 | 2 | laforge | |
14 | 4 | laforge | === Method 1: [wiki:osmo-nitb] PCAP option (obsolete) === |
15 | 2 | laforge | |
16 | 4 | laforge | The [wiki:osmo-nitb] application inside openbsc provides a command line option to automatically create a PCAP file. The resulting dump is only a subset of what is actually transmitted over the wire. Currently only Link Access Protol D-Channel (LAPD) messages are logged, the actual LAPD header is spoofed and only the TEI and SAPI information is invalid. This is mostly due mISDN not providing us with a LAPD header/frame and the encapsulation we use for wiretap/pcap. In the future there might be a dedicated encapsulation type for the complete mISDN traffic. |
17 | 1 | ||
18 | 4 | laforge | To write the protocol dump simply invoke [wiki:osmo-nitb]: |
19 | 3 | laforge | {{{ |
20 | 4 | laforge | ./osmo-nitb -p networking.pcap |
21 | 3 | laforge | }}} |
22 | 2 | laforge | === Method 2: Using misdn_log === |
23 | |||
24 | This is the preferred method in case you are using the mISDN input driver for OpenBSC, e.g. with a BS-11 BTS. |
||
25 | |||
26 | 1 | In order to obtain a A-bis capture and save it in a pcap file, please use the ''misdn_log'' tool (part of mISDNuser) |
|
27 | the following way: |
||
28 | 3 | laforge | {{{ |
29 | 2 | laforge | misdn_log -c0 -w networking.pcap |
30 | 3 | laforge | }}} |
31 | 4 | laforge | Please make sure to '''first start [wiki:osmo-nitb]''' and only then start ''misdn_log'' |
32 | 2 | laforge | |
33 | 1 | === Method 3: Using tcpdump === |
|
34 | 2 | laforge | |
35 | 1 | If you're using an ''A-bis over IP'' based BTS such as the [nanoBTS], then you can use a regular tool like |
|
36 | tcpdump to create a pcap file |
||
37 | 3 | laforge | {{{ |
38 | 2 | laforge | tcpdump -ni eth0 -s 0 -w networking.pcap |
39 | 3 | laforge | }}} |
40 | where ''eth0'' is the name of the network device connected to the same network as the nanoBTS. |
||
41 | 2 | laforge | |
42 | 1 | == Viewing == |
|
43 | 2 | laforge | |
44 | 1 | Wireshark already provides dissectors for the various protocols we use (LAPD, RSL, GSM-A, GSM-SMS...). The LAPD protocol dissector needs some minor configuration though. Go to Edit -> Preferences -> Protocols -> LAPD and check the checkbox saying "Use GSM Sapi Values". Afterwards wireshark will be able to display a lot of the A-bis protocol. There are some glitches in the protocol analysis, some missing features and dissection of OML is completely missing. |
|
45 | |||
46 | 2 | laforge | Also, only the most recent wireshark development versions contain a dissector for the ''ip.access A-bis over IP protocol''. |
47 | We recommend you to build wireshark from the latest source code, or alternatively apply the patch that is found in the wireshark |
||
48 | directory of our git repository. |
||
49 | |||
50 | === A-bis OML dissector === |
||
51 | |||
52 | To add a dissector for the GSM 12.21 A-bis Organization and Maintenance Layer (OML), you can use the ''abis_oml.patch'' file |
||
53 | from the wireshark directory of our git repository. This will be submitted for inclusion into wireshark soon. |
||
54 | |||
55 | 1 | == Dumps for you == |
|
56 | 2 | laforge | |
57 | 1 | Here are some dumps that might be useful. Make sure that you only provide data from your own network and equipment (no IMSI/IMEI you do not know...) |