• Table of contents
• PCAP and protocol analysis
• Recording and viewing A-bis communication
  • Recording
    • Method 1: Using tcpdump
    • Method 2: osmo-nitb PCAP option (obsolete)
    • Method 3: Using misdn_log
  • Viewing
    • A-bis OML dissector
  • Dumps for you

PCAP and protocol analysis¶

You can take protocol traces of the communication bewtwween OpenBSC and your BTS. This includes the signalling between BTS and BSC,
but also includes the sognalling with all the subscribers/phones currently using the OpenBSC instance.

pcap is a data format for captured packets of communication protocols. It is used by a library called libpcap, which in turn is
used by popular network protocol analyzer projects such as tcpdump and wireshark.

In the Ethernet/Internet world, you typically capture packets from your ethernet card using RAW sockets and promiscuous mode.

With GSM protocols such as A-bis, it is obviously not that simple - since they are at least traditionally not transported over IP.

Recording and viewing A-bis communication¶

Recording¶

Method 1: Using tcpdump¶

If you're using an A-bis over IP based BTS such as any OsmoBTS based BTS or the [nanoBTS], then you can use a regular tool like
tcpdump to create a pcap file

  tcpdump -ni eth0 -s 0 -w networking.pcap

where eth0 is the name of the network device connected to the same network as the nanoBTS.

If you would like to filter on only Abis traffic, make sure you capture only tcp ports 3002 and 3003, as well as 23000 for SGSN/Gb traffic.

Method 2: osmo-nitb PCAP option (obsolete)¶

The osmo-nitb application inside openbsc provides a command line option to automatically create a PCAP file.

This method is the standard method when using any E1/T1 based A-bis interface, such as mISDN or DAHDI.

If you're using the kernel-based mISDN LAPD implementation, the resulting dump is only a subset of what is actually transmitted over the wire. Currently only Link Access Protol D-Channel (LAPD) messages are logged, the actual LAPD header is spoofed and only the TEI and SAPI information is valid. This is mostly due mISDN not providing us with a LAPD header/frame and the encapsulation we use for wiretap/pcap.

For the libosmocore based userspace LAPD implementation (always for DAHDI, in mISDN optional), you will see the full LAPD header.

To write the protocol dump simply invoke osmo-nitb:

  ./osmo-nitb -p networking.pcap

Method 3: Using misdn_log¶

This is the preferred method in case you are using the mISDN input driver for OpenBSC, e.g. with a BS-11 BTS.

In order to obtain a A-bis capture and save it in a pcap file, please use the misdn_log tool (part of mISDNuser)
the following way:

  misdn_log -c0 -w networking.pcap

Please make sure to first start osmo-nitb and only then start misdn_log

Viewing¶

Wireshark already provides dissectors for the various protocols we use (LAPD, RSL, GSM-A, GSM-SMS...). The LAPD protocol dissector needs some minor configuration though. Go to Edit -> Preferences -> Protocols -> LAPD and check the checkbox saying "Use GSM Sapi Values". Afterwards wireshark will be able to display a lot of the A-bis protocol. There are some glitches in the protocol analysis, some missing features and dissection of OML is completely missing.

Also, only the most recent wireshark development versions contain a dissector for the ip.access A-bis over IP protocol.
We recommend you to build wireshark from the latest source code, or alternatively apply the patch that is found in the wireshark
directory of our git repository.

A-bis OML dissector¶

To add a dissector for the GSM 12.21 A-bis Organization and Maintenance Layer (OML), you can use the abis_oml.patch file
from the wireshark directory of our git repository. This will be submitted for inclusion into wireshark soon.

Dumps for you¶

Here are some dumps that might be useful. Make sure that you only provide data from your own network and equipment (no IMSI/IMEI you do not know...)