Cellular Network Infrastructure » Radio Access Network » OsmoBSC

{{>toc}}

h1. PCAP and protocol analysis

You can take protocol traces of the communication between OpenBSC, OsmoBSC or OsmoNITB and your BTS.  This includes the signalling between BTS and BSC, but also includes the signalling with all the subscribers/phones currently using the Osmocom network.

pcap is a data format for captured packets of communication protocols.  It is used by a library called libpcap, which in turn is used by popular network protocol analyzer projects such as tcpdump and wireshark.

In the Ethernet/Internet world, you typically capture packets from your Ethernet card using RAW sockets and promiscuous mode.

With GSM protocols such as classic A-bis iver E1, it is obviously not that simple - since they are at least traditionally not transported over IP.

h1. Recording and viewing A-bis communication

h2. Recording

h3. Method 1: Using tcpdump (Abis over IP)

If you're using an _A-bis over IP_ based BTS such as any [[OsmoBTS:]] based BTS or the [[nanoBTS]], then you can use a regular tool like @tcpdump@ to create a pcap file

<pre>

  tcpdump -ni eth0 -s 0 -w networking.pcap

</pre>

where _eth0_ is the name of the network device connected to the same network as the BTS.

If you would like to filter on only Abis traffic, make sure you capture only tcp ports 3002 and 3003, as well as 23000 for SGSN/Gb traffic.

h3. Method 2: [[osmo-nitb]] PCAP option (obsolete)

The [[osmo-nitb]] application inside openbsc provides a command line option to automatically create a PCAP file. 

This method is the standard method when using any E1/T1 based A-bis interface, such as mISDN or DAHDI.

If you're using the kernel-based mISDN LAPD implementation, the resulting dump is only a subset of what is actually transmitted over the wire. Currently only Link Access Protol D-Channel (LAPD) messages are logged, the actual LAPD header is spoofed and only the TEI and SAPI information is valid. This is mostly due mISDN not providing us with a LAPD header/frame and the encapsulation we use for wiretap/pcap.

For the libosmocore based userspace LAPD implementation (always for DAHDI, in mISDN optional), you will see the full LAPD header.

To write the protocol dump simply invoke [[osmo-nitb]]:

<pre>

  ./osmo-nitb -p networking.pcap

</pre>

h3. Method 3: Using misdn_log

This is the preferred method in case you are using the mISDN input driver for [[OpenBSC]], e.g. with a BS-11 or other E1 based BTS.

In order to obtain a A-bis capture and save it in a pcap file, please use the _misdn_log_ tool (part of mISDNuser)

the following way:

<pre>

  misdn_log -c0 -w networking.pcap

</pre>

Please make sure to *first start [[osmo-nitb]]* and only then start _misdn_log_

h2. Viewing / wireshark settings

Wireshark already provides dissectors for the various protocols we use (LAPD, RSL, GSM-A, GSM-SMS...). 

h3. LAPD

The LAPD protocol dissector needs some minor configuration. Go to Edit -> Preferences -> Protocols -> LAPD and check the checkbox saying *Use GSM Sapi Values*. Afterwards wireshark will be able to display 

h3. Abis over IP (gsm_ipa)

wireshark contains a dissector for the IPA multiplex, which is used in Abis-over-IP by [[nanoBTS]] or [[OsmoBTS:]] devices.

h3. A-bis OML (gsm_abis_oml)

Make sure you are selecting the OML dialect that matches your BTS vendor/model.  This can be done in the 

*A-bis OML dialect to be used* preference of the OML dissector. You have the following options:

* ETSI/3GPP TS 12.21 (just those common parts that are specified by 3GPP)

* Siemens (for BS-11 and other Siemens BTSs)

* ip.access (for [[nanoBTS]] and [[OsmoBTS:]])

* Ericsson OM2000 (for Ericsson RBS2000 + RBS6000)

h3. A-bis RSL (gsm_abis_rsl)

If you're using Abis/IP with [[nanoBTS]] or [[OsmoBTS:]], you should check the *use nanoBTS definitions* protocol preference setting.  It enables decoding of vendor-specific messages and information elements, such as the IPA CRCX/MDCX/DLCX.

h2. Dumps for you

Here are some dumps that might be useful. Make sure that you only provide data from your own network and equipment (no IMSI/IMEI you do not know...)