Project

General

Profile

Actions

Open5GS-Traces » History » Revision 35

« Previous | Revision 35/40 (diff) | Next »
jolly, 02/01/2024 03:40 PM


Open5GS-Traces

Setup of this example

  • Ericsson RBS 6402 (eNodeB)
  • Open5GS (4G network elements)
  • OsmoHLR with OsmoDia2GSUP (HSS)
  • OsmoMSC (SMS)

Idle

When all phones are Idle, one will see the following trace with Wireshark on the link between eNodeB (Ericsson RBS) and MME (Open5GS).

wireshark_enb_idle.png

The eNodeB (IP 10.0.15.117) is connected to MME (IP 10.0.15.1) via SCTP. Also the eNodeB syncs its clock to NTP server (IP 10.0.15.1).

The network 10.0.15.0/24 is the RAN network in this example.

4G Attachment

The phone is turned on and ready to attach to 4G network. The filter of Wireshark is set to "s1ap", so that only packages between eNodeB and MME are shown.

wireshark_enb_attach.png

A 4G phone is attached to the network, using SIM cards that is registered in the HSS. The APN name used is "internet".

Lets go into detail:

Attach request

wireshark_enb_attach_attach_request.png

The UE sends an "Attach request". It is the message type of the "NAS-PDU" information element of the "initiatingMessage". The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the "NAS-PDU" is the "EPS mobile identity". In this case the UE has the mobile country code "999" and the mobile network code "10". The IMSI is not shown. Because the UE was attached before, a TMSI is used.

If the mobile station was not registered to the MME, the MME will request identity and authentication and send "Attach Request" again after enabling encryption

"Identity request" and "Identity response"

wireshark_enb_attach_identity_request.png

Because identity is not know, the MME requests IMSI, as . (The MME was restartet before this trace, so that the TMSI is unknown.)

The MME sends an "Identity request" to the UE. The "NAS-PDU" message type is highlighted blue in the picture above. The identity type requested is highlighted light blue in the picture above.

wireshark_enb_attach_identity_response.png

The MME receives the response with IMSI. Again, the "NAS-PDU" message type is highlighted blue in the picture above. The mobile identity is highlighted light blue in the picture above. The IMSI is now known to the MME.

"Authentication request" and "Authentication response"

wireshark_enb_attach_authentication_request.png

The MME sends an "Authentication request" to the UE. The "NAS-PDU" message type is highlighted blue in the picture above.

A random value "RAND" and authentication parameters "AUTN" are used to request authentication from UE.

wireshark_enb_attach_authentication_response.png

The UE sends an "Authentication response" to the UE. The "NAS-PDU" message type is highlighted blue in the picture above.

The result "RES" is returned to the MME. (Highlighted light blue in the picture above.)

The subsequent “Security mode command” and “Security mode complete” messages are not depicted. The latter message is sent after encryption between UE and eNodeB is enabled. The message also carries the Attach request again.

"ESM information request" and "ESM information response"

wireshark_enb_attach_ESM_infomation_request.png

The MME sends an "ESM information request" to the UE, to request APN name. The "NAS-PDU" message type is highlighted blue in the picture above.

wireshark_enb_attach_ESM_infomation_response.png

The UE send an "ESM information response." The UE uses the APN name "internet". The "NAS-PDU" message type is highlighted blue in the picture above.

This is the default configuration in the example setup. It can be configured in the configuration file for OsmoHLR. (osmo-hlr.cfg)

"Attach accept"

wireshark_enb_attach_attach_accept.png

The MME sends an "Attach accept" to the UE. The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the “NAS-PDU” is an “ESM message container” with an “EPS session management message” to activate the default EPS bearer context. (Highlighted light blue in the picture above.)

The subsequent “InitialContextSetupResponse” and “UECapabilityInfoIndication” messages are not depicted. The latter message contains capabilities of the UE.

"Attach complete"

wireshark_enb_attach_attach_complete.png

Finally the UE sends an "Attach complete". The "NAS-PDU" message type is highlighted blue in the picture above.
Also within the “NAS-PDU” is an “ESM message container” with an “Activate default EPS bearer context accept”. (Highlighted light blue in the picture above.)

Packet transfer

wireshark_enb_gtp_1.png

The "GPRS Tunneling Protocol" (GTP) is used to tunnel packet traffic of the user plane. between eNodeB and SGW.

wireshark_enb_gtp_2.png

As depicted above, the GTP packet transmitted from the eNodeB (IP 10.0.15.117) to the SGW (IP 10.0.15.3).

The carried packet is transmitted from the UE (IP 10.0.6.2) to the destination in the Internet (IP 104.26.15.42)

4G Detachment

The 4G phone is turned off or the airplane mode is turned on. The phone detaches from network.

wireshark_enb_detach.png

Lets go into detail:

"Detach Request"

wireshark_enb_detach_detach_request.png

Similar to the "Attach request", described above, the UE sends an "Detach request". It is the message type of the "NAS-PDU" information element of the "initiatingMessage". The "NAS-PDU" message type is highlighted blue in the picture above.

Also within the "NAS-PDU" is the "EPS mobile identity". This is also similar to the "Attach request".

The subsequent “UEContextReleaseCommand” message (sent from EMM) and “UEContextREleaseComplete” messages (sent from UE) are not depicted.

Attachment inside EPC

After authentication is done and after receiving ESM information (e.g. APN), a session is created between network elements inside the Envolved Packet Code (EPC).

wireshark_epc_attach.png

MME -> SGWc

As depicted in the Wireshark picture above, the MME sends "Create Session Request" towards the control plane of the SGW. The GPRS tunneling protocol (GTP) is used. The request is depicted at frame number 254, the response at frame number 266.

SGWc -> SGWu

After receiving the "Create Session Request" from the MME, the control plane of the SGW sends a "PFCP Session Establishment Request" to the user plane of the SGW. The packet forwarding control protocol (PFCP) is used. The request is depicted at frame number 255, the response at frame number 257.

SGWc -> PGWc

The control plane of the SGW also sends a "Create Session Request" to the control plane of the PGW. The GPRS tunneling protocol (GTP) is used here again. The request is depicted at frame number 258, the response at frame number 263.

PGWc -> PCRF

The control plane of the PGW sends a "Credit-Control Request" to the PCRF. The Diameter protocol is used. The request is depicted at frame number 259, the answer at frame number 260.

PGWc -> PGWu

After receiving the "Credit-Control Answer" from the PCRF, the control plane of the PGW sends a "PFCP Session Establishment Request" to the user plane of the PGW. The packet forwarding control protocol (PFCP) is used here again. The request is depicted at frame number 261, the response at frame number 262.

SGWc -> SGWu

After receiving the "Create Session Response" from the control plane of the PGW, the control plane of the SGW sends a "PFCP Session Modification Request" to the user plane of the SGW. The packet forwarding control protocol (PFCP) is used here again. The request is depicted at frame number 264, the response at frame number 265.

Files (23)
wireshark_enb_idle.png View wireshark_enb_idle.png 62.2 KB Wireshark eNB Idle jolly, 01/29/2024 01:19 PM
wireshark_enb_attach_attach_request.png View wireshark_enb_attach_attach_request.png 153 KB jolly, 01/29/2024 02:07 PM
wireshark_enb_attach_ESM_infomation_request.png View wireshark_enb_attach_ESM_infomation_request.png 91.6 KB jolly, 01/29/2024 02:08 PM
wireshark_enb_attach_ESM_infomation_response.png View wireshark_enb_attach_ESM_infomation_response.png 86.6 KB jolly, 01/29/2024 02:08 PM
wireshark_enb_attach_attach_accept.png View wireshark_enb_attach_attach_accept.png 186 KB jolly, 01/29/2024 02:08 PM
wireshark_enb_attach_attach_complete.png View wireshark_enb_attach_attach_complete.png 98.8 KB jolly, 01/29/2024 02:08 PM
wireshark_enb_detach_detach_request.png View wireshark_enb_detach_detach_request.png 115 KB jolly, 01/29/2024 02:08 PM
wireshark_enb_gtp_2.png View wireshark_enb_gtp_2.png 32.8 KB jolly, 01/30/2024 11:20 AM
wireshark_enb_gtp_1.png View wireshark_enb_gtp_1.png 102 KB jolly, 01/30/2024 11:20 AM
wireshark_enb_attach.png View wireshark_enb_attach.png 92.8 KB jolly, 01/31/2024 09:15 AM
wireshark_enb_detach.png View wireshark_enb_detach.png 21.6 KB jolly, 01/31/2024 09:19 AM
wireshark_enb_attach_authentication_response.png View wireshark_enb_attach_authentication_response.png 80.6 KB jolly, 01/31/2024 10:12 AM
wireshark_enb_attach_authentication_request.png View wireshark_enb_attach_authentication_request.png 93.5 KB jolly, 01/31/2024 10:12 AM
wireshark_enb_attach_identity_request.png View wireshark_enb_attach_identity_request.png 59.9 KB jolly, 01/31/2024 10:12 AM
wireshark_enb_attach_identity_response.png View wireshark_enb_attach_identity_response.png 77.4 KB jolly, 01/31/2024 10:12 AM
attach_detach.pcapng attach_detach.pcapng 57.9 KB PCAP of attachment and detachment jolly, 01/31/2024 02:04 PM
wireshark_epc_attach.png View wireshark_epc_attach.png 82.2 KB jolly, 02/01/2024 10:07 AM
enb_attach.msc enb_attach.msc 769 Bytes jolly, 02/01/2024 11:20 AM
enb_attach.png View enb_attach.png 40.3 KB jolly, 02/01/2024 11:20 AM
enb_detach.msc enb_detach.msc 231 Bytes jolly, 02/01/2024 11:20 AM
enb_detach.png View enb_detach.png 10.6 KB jolly, 02/01/2024 11:20 AM
epc_attach.msc epc_attach.msc 786 Bytes jolly, 02/01/2024 11:21 AM
epc_attach.png View epc_attach.png 40.6 KB jolly, 02/01/2024 11:21 AM

Updated by jolly 26 days ago · 35 revisions

Add picture from clipboard (Maximum size: 48.8 MB)