ProtocolTracing » History » Version 2
laforge, 02/19/2016 10:47 PM
add more information on different pcap methods and wireshark patches
1 | 2 | laforge | = PCAP and protocol analysis = |
---|---|---|---|
2 | |||
3 | pcap is a data format for captured packets of communication protocols. It is used by a library called libpcap, which in turn is |
||
4 | used by popular network protocol analyzer projects such as tcpdump and wireshark. |
||
5 | |||
6 | In the Ethernet/Internet world, you typically capture packets from your ethernet card using RAW sockets and promiscuous mode. |
||
7 | |||
8 | With GSM protocols such as A-bis, it is obviously not that simple - since they are at least traditionally not transported over IP. |
||
9 | |||
10 | 1 | = Recording and viewing A-bis communication = |
|
11 | |||
12 | == Recording == |
||
13 | 2 | laforge | |
14 | === Method 1: bsc_hack PCAP option (obsolete) === |
||
15 | |||
16 | 1 | The bsc_hack application inside openbsc provides a command line option to automatically create a PCAP file. The resulting dump is only a subset of what is actually transmitted over the wire. Currently only Link Access Protol D-Channel (LAPD) messages are logged, the actual LAPD header is spoofed and only the TEI and SAPI information is invalid. This is mostly due mISDN not providing us with a LAPD header/frame and the encapsulation we use for wiretap/pcap. In the future there might be a dedicated encapsulation type for the complete mISDN traffic. |
|
17 | |||
18 | To write the protocol dump simply invoke bsc_hack: |
||
19 | ./bsc_hack -p networking.pcap |
||
20 | |||
21 | 2 | laforge | === Method 2: Using misdn_log === |
22 | |||
23 | This is the preferred method in case you are using the mISDN input driver for OpenBSC, e.g. with a BS-11 BTS. |
||
24 | |||
25 | In order to obtain a A-bis capture and save it in a pcap file, please use the ''misdn_log'' tool (part of mISDNuser) |
||
26 | the following way: |
||
27 | |||
28 | misdn_log -c0 -w networking.pcap |
||
29 | |||
30 | Please make sure to '''first start bsc_hack''' and only then start ''misdn_log'' |
||
31 | |||
32 | === Method 3: Using tcpdump === |
||
33 | |||
34 | If you're using an ''A-bis over IP'' based BTS such as the [nanoBTS], then you can use a regular tool like |
||
35 | tcpdump to create a pcap file |
||
36 | |||
37 | tcpdump -ni eth0 -s 0 -w networking.pcap |
||
38 | |||
39 | 1 | == Viewing == |
|
40 | 2 | laforge | |
41 | 1 | Wireshark already provides dissectors for the various protocols we use (LAPD, RSL, GSM-A, GSM-SMS...). The LAPD protocol dissector needs some minor configuration though. Go to Edit -> Preferences -> Protocols -> LAPD and check the checkbox saying "Use GSM Sapi Values". Afterwards wireshark will be able to display a lot of the A-bis protocol. There are some glitches in the protocol analysis, some missing features and dissection of OML is completely missing. |
|
42 | |||
43 | 2 | laforge | Also, only the most recent wireshark development versions contain a dissector for the ''ip.access A-bis over IP protocol''. |
44 | We recommend you to build wireshark from the latest source code, or alternatively apply the patch that is found in the wireshark |
||
45 | directory of our git repository. |
||
46 | |||
47 | === A-bis OML dissector === |
||
48 | |||
49 | To add a dissector for the GSM 12.21 A-bis Organization and Maintenance Layer (OML), you can use the ''abis_oml.patch'' file |
||
50 | from the wireshark directory of our git repository. This will be submitted for inclusion into wireshark soon. |
||
51 | |||
52 | 1 | == Dumps for you == |
|
53 | 2 | laforge | |
54 | 1 | Here are some dumps that might be useful. Make sure that you only provide data from your own network and equipment (no IMSI/IMEI you do not know...) |