Le 2 janv. 2016 9:22 PM, "Karunkaran Kumar" <skam4kumar@xxxxxxxxx> a écrit :
>
> Hi all,
>
> I recently learned about the LTE support on wireshark -- mac-lte, rlc-lte, pdcp-lte and rrc-lte.
> The heuristic dissection (i.e., using UDP framing) of the lower layers (i.e., mac,rlc,pdcp) fits my needs exactly.
> However, the rrc-lte apparently does not have have such an analogous UDP framing format and heuristic dissection. (Kindly correct me if I am wrong).
>
> I am actually in need of such a functionality. I however do not want to add pseudo mac/rlc headers and use the existing UDP framing. So is it a good idea to try and write a heuristic dissector for this?
>
> As far as my understanding goes, I would require one TAG field perpended to the RRC packet, which would identify the type of the RRC packet -- i.e., BCCH.BCH, BCCH.DL.SCH, DL.CCCH, PCCH, etc...
> The reason I think so, is because the 3GPP message decoder (http://3gppdecoder.free.fr/?q=node/1) given in the RRC-LTE web page (https://wiki.wireshark.org/LTE%20RRC) takes a byte stream and a combo-box with these options (BCCH.BCH, BCCH.DL.SCH, DL.CCCH, PCCH, etc...) alone for decoding the packet.
>
> Could anyone kindly advise me on this. Is this correct and whether or not it is a good idea to do this... I saw that few others have also wanted such a similar heuristic decoder for rrc, however they were suggested workarounds as mentioned above (using pseudo mac/rlc layer).
>
> Looking forward to a reply,
> with regards,
> k kumar
>
> PS: I am a HUGE fan of Wireshark. :)
>
Hi Kumar,
I'm not sure adding another UDP based heuristic dissector in the official source code base for LTE RRC would be really useful (as the only thing needed is to identify the PDU type which corresponds to a specific dissector already registered by name, contrary to MAC/RLC/PDCP dissectors that usually request more meta data).
You have several ways to handle this yourself though:
- write your own UDP based plugin or embedded dissector that would do the framing you are suggesting (it is very easy to do)
- use Wireshark Upper PDUs DLT format (see https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob;f=epan/exported_pdu.h;h=087c91ec8ac4a396fa89e667bf07f12b804c2547;hb=HEAD for more details). I'm using it myself for some tools and it perfectly fit your need
- assign a user DLT to each PDU type and configure Wireshark to call the corresponding dissector
Best regards,
Pascal.
