Abstract image of a woman sitting on books and studying on a laptop

06.pptx

Download as PPTX, PDF
L
LibaBali

Mark Stout from T-Mobile presented on using Wireshark to analyze LTE and 5G network protocols. He discussed the key protocols used including SCTP, Diameter, GTP, and S1AP. He explained how these protocols are used between different network elements like the UE, eNodeB, MME, S-GW and P-GW. He also provided tips on setting up Wireshark profiles to effectively analyze packets for these protocols.

Technology
1 of 44
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
#sf21vus Using wireshark in LTE, and 5G networks… Mark Stout T - M o b i l e
#sf21vus Mark Stout T-Mobile Using wireshark in LTE, and 5G networks…
#sf21vus About me? • In wireless technology CDMA/LTE/5G since 1998 • Work on various OEM’s • Cisco • Ericsson • Nokia • Nortel
#sf21vus UE eNodeB eNodeB MME S-GW P-GW HSS PCRF Uu Uu X2 S1-U Enhanced Packet Core (EPC) S11 S6a S5/S8 Gx SGi Internet E-UTRAN We will concentrate on packets entering, exiting, and within the highlighted portion. S1-MME UE User Equipment, Users phone, or device eNodeB Radio Access side of the network MME Local Mobility Management Entity. Only handles signaling for call setup, and certain hand offs S-GW Serving Gateway. Mobility anchor point. Handles signaling, and data plane P-GW PDN-GW. Packet Data Network Gateway. Provides IP, and session connectivity(UE Anchor). HSS Home Subscriber Server. Houses subscriber related information, and provides Authentication, and Authorization. PCRF Policy and Charging Function. **Certain nodes are not represented for simplicity
#sf21vus Protocols we’re covering MME S-GW P-GW HSS PCRF S1-U S11 S6a S5/S8 Gx SGi Internet S1-MME S1ap GTP-C GTP-C GTP-U GTP-U Diameter Diameter • SCTP – Session Control Transmission Protocol • Diameter • GTP – GPRS Tunneling Protocol • S1ap – S1 Application Protocol • Then 5G SCTP SCTP UDP UDP UDP TCP
#sf21vus SCTP Stream Control Transmission Protocol RFC4960 • Not datagrams, nor Segments, SCTP uses Chunks. • Chunk: Unit of information within an SCTP packet. Chunks contain either user data, or SCTP control data. • Multiple chunks can be bundled into one SCTP packet up to the MTU size, except for the INIT, INIT ACK, and SHUTDOWN COMPLETE chunks. • Endpoint: The logical sender/receiver of SCTP packets. On a multi-homed host, an SCTP endpoint is represented to its peers as a combination of a set of eligible destination transport addresses to which SCTP packets can be sent and a set of eligible source transport addresses from which SCTP packets can be received. • SCTP uses stream as the logical channel for transporting in-order application messages. A stream is defined as unidirectional
#sf21vus SCTP Stream Control Transmission Protocol RFC4960 • Association establishment and shutdown. SCTP uses a cookie mechanism in a four-way handshake to establish an association. • The shutdown process is a three-way handshake.
#sf21vus Redundancy built in Multihoming can be established at time of init ack. This is how we dynamically build redundant route from Cell Site, to MME. Redundant route start heart beat.
#sf21vus SCTP Stream Control Transmission Protocol RFC4960 • Selective Ack’s • The acknowledgements carry all Transmission Sequence Number (TSN) numbers that have been received by one side with them. • That is, there is a Cumulative TSN Ack value, that indicates all the data that has successfully been reassembled at the receivers side. • there are Gap Blocks that indicate which segments of data chunks have arrived, with some data chunks missing in between. • Path Monitoring • HEARTBEAT chunks are sent over all paths. Each HEARTBEAT chunk has to be acknowledged by a HEARTBEAT-ACK chunk. • Each path is assigned a state: active or inactive. • The number of events in which heartbeats were not acknowledged within a certain time or the number of retransmission events exceeds a certain configurable limit, the peer endpoint is considered unreachable and the association will be terminated via an ABORT chunk.
#sf21vus Selective Acknowledgement (SACK) 14
#sf21vus Selective Acknowledgement (SACK) 15
#sf21vus SCTP Stream Control Transmission Protocol RFC4960 • S1 peering setup
#sf21vus SCTP profile • Create a button to remove heartbeats/acks • Create columns to show the stream, gap count, and TSN • Create a color rule that shows you when gaps are present • Create a color rule that shows sctp layer fragments • I always create a color rule that shows the start of a peer, or session.
#sf21vus Diameter • Diameter is the protocol used within the EPC architecture for AAA (Authentication, Authorization, and Accounting), PCRF (Policy and Charging Rules Function), and HSS (Home Subscriber Server). • Diameter is specified in RFC 3588 and then by the RFC 6733 which obsoletes RFC 3588. • The name is a pun on the name of the predecessor protocol, RADIUS(Remote Authentication Dial In User Service) - a diameter is twice the radius.
#sf21vus Diameter • I-Send-Conn-Req = SYN • Wait-Conn-Ack = SYN, ACK • I-Rcv-Conn-Ack = ACK • I-Send-CER = send Capabilities Exchange Request • I-Wait-I-CEA = ACK • I-Rcv-CEA = receive Capabilities Exchange Answer Peering State Machine
#sf21vus Diameter • Capabilities-Exchange-Request CER 275 • Capabilities-Exchange-Answer CEA 275 • Device-Watchdog-Request DWR 280 • Device-Watchdog-Answer DWA 280 • Disconnect-Peer-Request DPR 282 • Disconnect-Peer-Answer DPA 282 • Abort-Session-Request ASR 274 • Abort-Session-Answer ASA 274 • Re-Auth-Request RAR 258 • Re-Auth-Answer RAA 258 • Session-Termination-Request STR 275 • Session-Termination-Answer STA 275 • Accounting-Request ACR 271 • Accounting-Answer ACA 271 All Diameter headers start with the same 20 bytes. After that AVP’s are added Diameter Header information
#sf21vus Diameter • All data delivered by diameter is in the form of AVPs (Attribute Value Pairs). Some of these AVP values are used by the Diameter protocol itself, while others deliver data associated with particular applications that employ Diameter. • Ability to exchange messages and deliver AVPs ( Attribute Value Pairs) • Capabilities negotiation • Error notification • Extensibility, required in [RFC2989], through addition of new applications, commands, and AVPs • Basic services necessary for applications, such as the handling of user sessions or accounting
#sf21vus Diameter • Diameter AVP’s carry a lot of data is asci format. Use it to your advantage using the “frame contains xxx” as a filter • You can also just click on the ascii portion of the “Packet Bytes” pane, and the AVP will open directly in the “Packet Details” view.
#sf21vus Diameter • The AVP’s are grouped in a parent, child relationship. This relationship is setup in readable xml files in the <wireshark home>/diameter directory. • This info is helpful when trying to find what AVP’s could be grouped under one parent, or to find documentation associated with that avp.
#sf21vus Diameter profile • Diameter has multiple request, and answer types. These can be in different AVP’s. Don’t build multiple columns for that. Use the custom column, and use || to define different AVP’s. • Create custom color rule for known bad issues, then show color rule in column.
#sf21vus Diameter profile Dictionary.xml is the main file, and is responsible for calling all the other specific files <avp name="Vendor-Id" code="266" mandatory="must" may-encrypt="no" protected="may" vendor-bit="mustnot"> <type type-name="VendorId"/> </avp> <avp name="Firmware-Revision" code="267" mandatory="mustnot" protected="mustnot" may-encrypt="no" vendor-bit="mustnot"> <type type-name="Unsigned32"/> </avp> <avp name="Result-Code" code="268" mandatory="must" may-encrypt="no" protected="mustnot" vendor-bit="mustnot"> <type type-name="Enumerated"/> <enum name="DIAMETER_MULTI_ROUND_AUTH" code="1001"/> <enum name="DIAMETER_SUCCESS" code="2001"/>
#sf21vus Diameter profile <avp name="Charging-Rule-Name" code="1005" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <type type-name="OctetString"/> </avp> <avp name="Event-Trigger" code="1006" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <type type-name="Enumerated"/> <enum name="SGSN_CHANGE" code="0"/> <enum name="QOS_CHANGE" code="1"/> <enum name="RAT_CHANGE" code="2"/> <enum name="TFT_CHANGE" code="3"/> <enum name="PLMN_CHANGE" code="4"/> <enum name="LOSS_OF_BEARER" code="5"/> </avp> In this example <avp starts the a new description name= defines the name that will show in wireshark for the code= defined type-name=“Enumerated = a number value that will later get a name assigned to the value OctetString = A string of octets ie. 0a ff cd bb UTF8String = text if “Enumerated” is defined then <enum name=“what ever” code=“0”/> associates a string with whatever number value is seen. Mandatory, May-encrypt, Protected, Vendor-bit = Not used in wireshark, but refers to the flags in the diameter message
#sf21vus Diameter profile <avp name="Charging-Rule-Install" code="1001" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <grouped> <gavp name="Charging-Rule-Definition"/> <gavp name="Charging-Rule-Name"/> <gavp name="Charging-Rule-Base-Name"/> <gavp name="Bearer-Identifier"/> <gavp name="Rule-Activation-Time"/> <gavp name="Rule-Deactivation-Time"/> <gavp name="Resource-Allocation-Notification"/> </grouped> </avp> <avp name="Charging-Rule-Base-Name" code="1004" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <type type-name="UTF8String"/> </avp>
#sf21vus GTP • GPRS Tunneling protocol is a IP/UDP based protocol used in GSM, UMTS and LTE core networks. It is used to encapsulate user data when passing through core network and also signaling traffic between various core network entities. • In LTE, version 2 is used for GTP-C and version 1 is used for GTP-U • In our shown LTE network implementation, GTP-v2 is used on S5 and S11 interfaces and GTPv1 is used on S1-U, S5. MME S-GW P-GW HSS PCRF S1-U S11 S6a S5/S8 Gx SGi Internet S1-MME GTP-C GTP-C GTP-U GTP-U
#sf21vus GTPv2  Different GTP-C messages are used to manage a Tunnel or to set up the tunnel for GTPv1.  GTP-C does not necessarily tunnel messages, as no payload is carried above GTP-C.  The GTP-C messages are Create Session, Create Bearer, Modify Bearer, Update Bearer, Delete Session, Delete Bearer.
#sf21vus GTPv1 • The transport bearer is identified by the GTP-U TEID and the IP address (source TEID, destination TEID, source IP address, destination IP address) • As Bearer is received over a TEID on S1-U at the SGW, the SGW then forwards on a different TEID towards the PGW.
#sf21vus GTP • While GTP is stateless the upper level protocols may not be. • GTPv2 should be diagnosed from request to response (or lack there of). • Looking at TCP over GTPv1 holds the best advantages for me. But there are things to look out for! • When you take a capture at the SGW, and PGW. You will see that wireshark shows 3 packets per 1. Then Wireshark will do TCP analysis on 3 packets, and mark all packets (except the first) with some error (retran, ooo) • You’ll also notice that WS will only show the upper most layer IP in the source/Destination field
#sf21vus GTP Editcap to remove true duplicate packets. Most useful on S5 interface that leaves SGW, and arrives at PGW. .editcap.exe -w .0001 -I 12 C:temproamingIssue.pcap C:temproamDedup.pcap 153 packets seen, 12 packets skipped with duplicate time window equal to or less than 0.000100000 seconds. Tshark can be used to remove dup’s across multiple GTP peers. S11 -> S5, or S1u->S5->SGi .tshark.exe -r 'C:shareTest_casesPCAPExportedData_1.pcap' -R "!(sctp.chunk_type == 5 || sctp.chunk_type == 4)" -2 -w C:tempnoSctpHeart.pcap For large files use capinfos to determine size, and calculate the size of the chunks that the pcap can be broken up into. Mergecap….. Tools, Tools, Tools, they are there for you.
#sf21vus editcap -s 128 superbowl.pcap superbowl_128.pcapng Take a larger trace and slice the packets after byte 128 and save to a new file. This means I won’t get the complete payload, but that is ok in the cases where your troubleshooting packet loss using TCP analysis. You can always go back to the original trace file if you need the payload. This will dramatically reduce the size of a trace. Split a large file into many smaller ones. editcap -c <number of packets per file> superbowl.pcap smallSuperbowl.pcap Becomes smallSuperbowl_0000.pacp _0001.pcap, smallSuperbowl_0000.pacp _0002.pcap, etc. Slicing packets in large traces file to reduce the file size
#sf21vus Recommend doing this before deduping packets. tshark.exe -r 4perToBeDeduped.pcap -T fields -e tcp.seq_raw | sort | uniq -c 4 1000461189 4 1218696134 4 1218697032 4 1218698412 4 1218699792 4 1218701172 1 2689484057 1 2689485425 1 2689486793 1 2689488161 4 2710474120 4 2710476617 4 2746774803 -T <def> = defines output type (fields, text, ps). When using –e this MUST be <fields> -e <field> = which field to print. Must be repeated print multiple fields Verify each packet has hit every tap
#sf21vus IMS / Volte Volte is really nothing more that SIP/RTP (VoIP) over LTE with a guaranteed bearer and more favorable DSCP markers on the packet. Most tools for SIP will work with trouble shooting Volte
#sf21vus A quick view into the nature, and timing of RTP packets. Knowing your RTP timers help when using these tools. Example; I know in this case active conversation packets are 20ms, and silent packets are 160ms RTP Stream Analysis
#sf21vus IO Graph for jitter/packet arrival 1. Find all RTP streams in the capture. 2. Pick one side of the stream you are looking for, then click “Find Reverse”. 3. Click “Prepare Filter”. 4. Go back to Wireshark main screen, and click the arrow in the display filter portion, to execute the filtering of the streams.
#sf21vus CTRL-V or Left side of conversation filter To get display filter expression  Open IO Graph  We know RTP active packet time is 20ms, so we’ll set interval to 1ms.  Our Y field will be udp.time_delta which will give us time of arrival delta between each packet that matches our display filter
#sf21vus Left graph depicts what we expect to see. That is 20ms time on active packets, and 160ms on silent packets. Using this graph you can tell who was speaking during this conversation. Right graph is showing the Caller with an active call time at 40ms instead of 20ms, with spikes down to 0ms. Hmm.
#sf21vus Set time format to “seconds since previous displayed packet” Adjust display filter to just show caller. We can now see that the caller sends 2 packets every 40ms. That is one at the 40ms mark, then another one within the same sub- millisecond. ?? This was found to be uplink packet time scheduling on the eNodeB. Packets could only be requested on the 40ms timeslot. So UE would send 2 at a time.
#sf21vus 4G to 5G What was combined functions on 4G have now been separated, and segregated into their own network functions Functions are now treated like services, and can be called upon with API like queries.
#sf21vus •Authentication Server Function (AUSF) acts as an authentication server. (part of HSS from EPC world) •Unified Data Management (UDM) supports: generation of Authentication and Key Agreement (AKA) credentials, user identification handling, access authorization, subscription management. (part of HSS functionality from EPC world) •Application Function (AF) supports: application influence on traffic routing, accessing NEF, interaction with policy framework for policy control. (same as AF in EPC world) •Network Exposure function (NEF) supports: exposure of capabilities and events, secure provision of information from external application to 3GPP network, translation of internal/external information. (not present in EPC world) •NF Repository function (NRF) supports: service discovery function, maintains NF profile and available NF instances. (not present in EPC world) •Network Slice Selection Function (NSSF) supports: selecting of the Network Slice instances to serve the UE, determining the allowed NSSAI, determining the AMF set to be used to serve the UE. (not present in EPC world) •Access and Mobility Management function (AMF) supports: Termination of NAS signaling, NAS ciphering & integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management. (AMF has part of the MME functionality from EPC world) •Session Management function (SMF) supports: session management (session establishment, modification, release), UE IP address allocation & management, DHCP functions, termination of NAS signaling related to session management, DL data notification, traffic steering configuration for UPF for proper traffic routing. (SMF has part of the MME and PGW functionality from EPC world) •User plane function (UPF) supports: packet routing & forwarding, packet inspection, QoS handling, acts as external PDU session point of interconnect to Data Network (DN), and is an anchor point for intra- & inter-RAT mobility. (UPF has part of the SGW & PGW functionality from EPC world) •Policy Control Function (PCF) supports: unified policy framework, providing policy rules to CP functions, access subscription information for policy decisions in UDR. (PCF has part of the PCRF functionality from EPC world) NETWORK FUNCTIONS
#sf21vus User plane protocols unchanged The highlighted part still uses GTP, like the previous 4G slides
#sf21vus S1AP has changed to NGAP, but is the same type of informational elements, just more Also is still on top of SCTP RAN Signaling
#sf21vus Core signaling over http2 • 4G diameter interfaces have now become JSON over HTTP2 (API like queries) • Multihome is now handled by NRF for querying control plane nodes for use.
#sf21vus HTTP2 information • Must have wireshark 3.4 or greater • Decode As: HTTP2 content type in stream, enter value, and set as JSON • Currently must be done for each stream ID
#sf21vus JSON over HTTP2 Current WS versions require you to filter like this This is not great, because it doesn’t match a key value pair. So any key with a value of “ACTIVATING” could be matched, as long as the key upCnxState exist. Development version allows for absolute filters While this allows for more exact filtering, there is still work to be done.
#sf21vus Q / A

More Related Content

PPTX
Introduction to Diameter Protocol - Part1
Basim Aly (JNCIP-SP, JNCIP-ENT)
 
PPTX
Diameter Presentation
Beny Haddad
 
PDF
Introduction to DIAMETER
Hossein Yavari
 
PDF
DIAMETER_EFORT_ENG.pdf
Abubakar416712
 
PDF
Network analysis Using Wireshark Lesson 11: TCP and UDP Analysis
Yoram Orzach
 
PDF
Mobicents Summit 2012 - Alexandre Mendonca - Mobicents jDiameter
telestax
 
PPT
Basic networking course
LuxoftTraining
 
ODP
Packet Radio Overview
Matthew Maguire
 
Introduction to Diameter Protocol - Part1
Basim Aly (JNCIP-SP, JNCIP-ENT)
 
Diameter Presentation
Beny Haddad
 
Introduction to DIAMETER
Hossein Yavari
 
DIAMETER_EFORT_ENG.pdf
Abubakar416712
 
Network analysis Using Wireshark Lesson 11: TCP and UDP Analysis
Yoram Orzach
 
Mobicents Summit 2012 - Alexandre Mendonca - Mobicents jDiameter
telestax
 
Basic networking course
LuxoftTraining
 
Packet Radio Overview
Matthew Maguire
 

Similar to 06.pptx (20)

PPTX
Diameter_Apr2014.pptx
LaCorrientedelGolfo
 
PDF
Diameter Penetration Test Lab
frcarlson
 
PPTX
Packet Analysis - Course Technology Computing Conference
Cengage Learning
 
PDF
Segment Routing
APNIC
 
PDF
BRKSP-2551 - Introduction to Segment Routing.pdf
fcesargonca
 
PPT
L2_Wireshark.ppt
LibaBali
 
PDF
Cisco Connect Montreal 2017 - Segment Routing - Technology Deep-dive and Adva...
Cisco Canada
 
DOCX
Assignment on data network
Abhishek Kesharwani
 
DOCX
Assignment on data network
Abhishek Kesharwani
 
PDF
Internet technology unit 4
WE-IT TUTORIALS
 
PDF
SCTP Overview
John Loughney
 
PPT
Generic framing procedure
Sudanshu Gupta
 
PDF
Segment Routing: A Tutorial
APNIC
 
ODP
Sockets and Socket-Buffer
Sourav Punoriyar
 
PDF
WAN SDN meet Segment Routing
APNIC
 
PPT
Ipspk1
supriya kurlekar
 
PPTX
Ready for the Evolution: LTE Session delivery requirements
AcmePacket
 
PPTX
IETF 79 - Diameter Over SCTP
Victor Pascual Ávila
 
PDF
Philippe Langlois - SCTPscan Finding entry points to SS7 Networks & Telecommu...
P1Security
 
PPTX
Scaling Diameter for LTE
AcmePacket
 
Diameter_Apr2014.pptx
LaCorrientedelGolfo
 
Diameter Penetration Test Lab
frcarlson
 
Packet Analysis - Course Technology Computing Conference
Cengage Learning
 
Segment Routing
APNIC
 
BRKSP-2551 - Introduction to Segment Routing.pdf
fcesargonca
 
L2_Wireshark.ppt
LibaBali
 
Cisco Connect Montreal 2017 - Segment Routing - Technology Deep-dive and Adva...
Cisco Canada
 
Assignment on data network
Abhishek Kesharwani
 
Assignment on data network
Abhishek Kesharwani
 
Internet technology unit 4
WE-IT TUTORIALS
 
SCTP Overview
John Loughney
 
Generic framing procedure
Sudanshu Gupta
 
Segment Routing: A Tutorial
APNIC
 
Sockets and Socket-Buffer
Sourav Punoriyar
 
WAN SDN meet Segment Routing
APNIC
 
Ipspk1
supriya kurlekar
 
Ready for the Evolution: LTE Session delivery requirements
AcmePacket
 
IETF 79 - Diameter Over SCTP
Victor Pascual Ávila
 
Philippe Langlois - SCTPscan Finding entry points to SS7 Networks & Telecommu...
P1Security
 
Scaling Diameter for LTE
AcmePacket
 
Ad

More from LibaBali (7)

DOCX
Drive_Test_Analysis_DTA_4G_LTE.docx
LibaBali
 
PDF
LTE_poster.pdf
LibaBali
 
PPTX
LTE_A_Telecoma_new.pptx
LibaBali
 
PPT
dokumen.tips_ericsson-lte-throughput-troubleshooting-techniques_SUPERRRRRRR.ppt
LibaBali
 
PPTX
393575910-318163030-E2E-VOLTE-pptx.pptx
LibaBali
 
PPT
dokumen.tips_ericsson-lte-throughput-troubleshooting-techniquesppt.ppt
LibaBali
 
PPTX
10.1152-advan.00083.2007Figure1.pptx
LibaBali
 
Drive_Test_Analysis_DTA_4G_LTE.docx
LibaBali
 
LTE_poster.pdf
LibaBali
 
LTE_A_Telecoma_new.pptx
LibaBali
 
dokumen.tips_ericsson-lte-throughput-troubleshooting-techniques_SUPERRRRRRR.ppt
LibaBali
 
393575910-318163030-E2E-VOLTE-pptx.pptx
LibaBali
 
dokumen.tips_ericsson-lte-throughput-troubleshooting-techniquesppt.ppt
LibaBali
 
10.1152-advan.00083.2007Figure1.pptx
LibaBali
 
Ad

Recently uploaded (20)

PPTX
Information-Technology-in-Human-Society.pptx
744tusharsingh094
 
PDF
Streamline Vulnerability Management From Minimal Images to SBOMs
Anchore
 
PPT
Overviiew on Intellectual property right
Ritu Maity
 
PPTX
CRM(Customer Relationship Managmnet) Presentation
udaykiranuk1822
 
PDF
Introduction to c language from lecture slides
sharmatribhuvnesh
 
PDF
Technical Debt in the AI Coding Era - By Antonio Bianco
davanacorona
 
PDF
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
PPTX
Strategic Picks — Prioritising the Right Agentic Use Cases [2/6]
suhanisingh58689
 
PDF
Connector Corner: Transform Unstructured Documents with Agentic Automation
DianaGray10
 
PPTX
How to use fields_get method in Odoo 18
Celine George
 
PPTX
maintenance powerrpoint for adaprive and preventive
aladortigabu
 
PDF
EGCB_Solar_Project_Presentation_and Finalcial Analysis.pdf
TaukirIslam
 
PDF
EIS-Webinar-Regulated-Industries-2025-08.pdf
Earley Information Science
 
PDF
AI.gov: A Trojan Horse in the Age of Artificial Intelligence
Michael Weaver
 
PDF
GDG Cloud Southlake #45: Patrick Debois: The Impact of GenAI on Development a...
James Anderson
 
PDF
Examining Bias in AI Generated News Content.pdf
Government
 
PPTX
Rise of the Digital Control Grid Zeee Media and Hope and Tivon FTWProject.com
hopegirl587
 
PDF
Optimizing bioinformatics applications: a novel approach with human protein d...
IAESIJAI
 
PPTX
Digital Convergence: How GIS, BIM, and CAD Revolutionize Asset Management
Richard Chappell, GISP
 
PDF
Chapter 1: computer maintenance and troubleshooting
BarnootaKomputeraaaf
 
Information-Technology-in-Human-Society.pptx
744tusharsingh094
 
Streamline Vulnerability Management From Minimal Images to SBOMs
Anchore
 
Overviiew on Intellectual property right
Ritu Maity
 
CRM(Customer Relationship Managmnet) Presentation
udaykiranuk1822
 
Introduction to c language from lecture slides
sharmatribhuvnesh
 
Technical Debt in the AI Coding Era - By Antonio Bianco
davanacorona
 
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
Strategic Picks — Prioritising the Right Agentic Use Cases [2/6]
suhanisingh58689
 
Connector Corner: Transform Unstructured Documents with Agentic Automation
DianaGray10
 
How to use fields_get method in Odoo 18
Celine George
 
maintenance powerrpoint for adaprive and preventive
aladortigabu
 
EGCB_Solar_Project_Presentation_and Finalcial Analysis.pdf
TaukirIslam
 
EIS-Webinar-Regulated-Industries-2025-08.pdf
Earley Information Science
 
AI.gov: A Trojan Horse in the Age of Artificial Intelligence
Michael Weaver
 
GDG Cloud Southlake #45: Patrick Debois: The Impact of GenAI on Development a...
James Anderson
 
Examining Bias in AI Generated News Content.pdf
Government
 
Rise of the Digital Control Grid Zeee Media and Hope and Tivon FTWProject.com
hopegirl587
 
Optimizing bioinformatics applications: a novel approach with human protein d...
IAESIJAI
 
Digital Convergence: How GIS, BIM, and CAD Revolutionize Asset Management
Richard Chappell, GISP
 
Chapter 1: computer maintenance and troubleshooting
BarnootaKomputeraaaf
 

06.pptx

  • 1. #sf21vus Using wireshark in LTE, and 5G networks… Mark Stout T - M o b i l e
  • 2. #sf21vus Mark Stout T-Mobile Using wireshark in LTE, and 5G networks…
  • 3. #sf21vus About me? • In wireless technology CDMA/LTE/5G since 1998 • Work on various OEM’s • Cisco • Ericsson • Nokia • Nortel
  • 4. #sf21vus UE eNodeB eNodeB MME S-GW P-GW HSS PCRF Uu Uu X2 S1-U Enhanced Packet Core (EPC) S11 S6a S5/S8 Gx SGi Internet E-UTRAN We will concentrate on packets entering, exiting, and within the highlighted portion. S1-MME UE User Equipment, Users phone, or device eNodeB Radio Access side of the network MME Local Mobility Management Entity. Only handles signaling for call setup, and certain hand offs S-GW Serving Gateway. Mobility anchor point. Handles signaling, and data plane P-GW PDN-GW. Packet Data Network Gateway. Provides IP, and session connectivity(UE Anchor). HSS Home Subscriber Server. Houses subscriber related information, and provides Authentication, and Authorization. PCRF Policy and Charging Function. **Certain nodes are not represented for simplicity
  • 5. #sf21vus Protocols we’re covering MME S-GW P-GW HSS PCRF S1-U S11 S6a S5/S8 Gx SGi Internet S1-MME S1ap GTP-C GTP-C GTP-U GTP-U Diameter Diameter • SCTP – Session Control Transmission Protocol • Diameter • GTP – GPRS Tunneling Protocol • S1ap – S1 Application Protocol • Then 5G SCTP SCTP UDP UDP UDP TCP
  • 6. #sf21vus SCTP Stream Control Transmission Protocol RFC4960 • Not datagrams, nor Segments, SCTP uses Chunks. • Chunk: Unit of information within an SCTP packet. Chunks contain either user data, or SCTP control data. • Multiple chunks can be bundled into one SCTP packet up to the MTU size, except for the INIT, INIT ACK, and SHUTDOWN COMPLETE chunks. • Endpoint: The logical sender/receiver of SCTP packets. On a multi-homed host, an SCTP endpoint is represented to its peers as a combination of a set of eligible destination transport addresses to which SCTP packets can be sent and a set of eligible source transport addresses from which SCTP packets can be received. • SCTP uses stream as the logical channel for transporting in-order application messages. A stream is defined as unidirectional
  • 7. #sf21vus SCTP Stream Control Transmission Protocol RFC4960 • Association establishment and shutdown. SCTP uses a cookie mechanism in a four-way handshake to establish an association. • The shutdown process is a three-way handshake.
  • 8. #sf21vus Redundancy built in Multihoming can be established at time of init ack. This is how we dynamically build redundant route from Cell Site, to MME. Redundant route start heart beat.
  • 9. #sf21vus SCTP Stream Control Transmission Protocol RFC4960 • Selective Ack’s • The acknowledgements carry all Transmission Sequence Number (TSN) numbers that have been received by one side with them. • That is, there is a Cumulative TSN Ack value, that indicates all the data that has successfully been reassembled at the receivers side. • there are Gap Blocks that indicate which segments of data chunks have arrived, with some data chunks missing in between. • Path Monitoring • HEARTBEAT chunks are sent over all paths. Each HEARTBEAT chunk has to be acknowledged by a HEARTBEAT-ACK chunk. • Each path is assigned a state: active or inactive. • The number of events in which heartbeats were not acknowledged within a certain time or the number of retransmission events exceeds a certain configurable limit, the peer endpoint is considered unreachable and the association will be terminated via an ABORT chunk.
  • 12. #sf21vus SCTP Stream Control Transmission Protocol RFC4960 • S1 peering setup
  • 13. #sf21vus SCTP profile • Create a button to remove heartbeats/acks • Create columns to show the stream, gap count, and TSN • Create a color rule that shows you when gaps are present • Create a color rule that shows sctp layer fragments • I always create a color rule that shows the start of a peer, or session.
  • 14. #sf21vus Diameter • Diameter is the protocol used within the EPC architecture for AAA (Authentication, Authorization, and Accounting), PCRF (Policy and Charging Rules Function), and HSS (Home Subscriber Server). • Diameter is specified in RFC 3588 and then by the RFC 6733 which obsoletes RFC 3588. • The name is a pun on the name of the predecessor protocol, RADIUS(Remote Authentication Dial In User Service) - a diameter is twice the radius.
  • 15. #sf21vus Diameter • I-Send-Conn-Req = SYN • Wait-Conn-Ack = SYN, ACK • I-Rcv-Conn-Ack = ACK • I-Send-CER = send Capabilities Exchange Request • I-Wait-I-CEA = ACK • I-Rcv-CEA = receive Capabilities Exchange Answer Peering State Machine
  • 16. #sf21vus Diameter • Capabilities-Exchange-Request CER 275 • Capabilities-Exchange-Answer CEA 275 • Device-Watchdog-Request DWR 280 • Device-Watchdog-Answer DWA 280 • Disconnect-Peer-Request DPR 282 • Disconnect-Peer-Answer DPA 282 • Abort-Session-Request ASR 274 • Abort-Session-Answer ASA 274 • Re-Auth-Request RAR 258 • Re-Auth-Answer RAA 258 • Session-Termination-Request STR 275 • Session-Termination-Answer STA 275 • Accounting-Request ACR 271 • Accounting-Answer ACA 271 All Diameter headers start with the same 20 bytes. After that AVP’s are added Diameter Header information
  • 17. #sf21vus Diameter • All data delivered by diameter is in the form of AVPs (Attribute Value Pairs). Some of these AVP values are used by the Diameter protocol itself, while others deliver data associated with particular applications that employ Diameter. • Ability to exchange messages and deliver AVPs ( Attribute Value Pairs) • Capabilities negotiation • Error notification • Extensibility, required in [RFC2989], through addition of new applications, commands, and AVPs • Basic services necessary for applications, such as the handling of user sessions or accounting
  • 18. #sf21vus Diameter • Diameter AVP’s carry a lot of data is asci format. Use it to your advantage using the “frame contains xxx” as a filter • You can also just click on the ascii portion of the “Packet Bytes” pane, and the AVP will open directly in the “Packet Details” view.
  • 19. #sf21vus Diameter • The AVP’s are grouped in a parent, child relationship. This relationship is setup in readable xml files in the <wireshark home>/diameter directory. • This info is helpful when trying to find what AVP’s could be grouped under one parent, or to find documentation associated with that avp.
  • 20. #sf21vus Diameter profile • Diameter has multiple request, and answer types. These can be in different AVP’s. Don’t build multiple columns for that. Use the custom column, and use || to define different AVP’s. • Create custom color rule for known bad issues, then show color rule in column.
  • 21. #sf21vus Diameter profile Dictionary.xml is the main file, and is responsible for calling all the other specific files <avp name="Vendor-Id" code="266" mandatory="must" may-encrypt="no" protected="may" vendor-bit="mustnot"> <type type-name="VendorId"/> </avp> <avp name="Firmware-Revision" code="267" mandatory="mustnot" protected="mustnot" may-encrypt="no" vendor-bit="mustnot"> <type type-name="Unsigned32"/> </avp> <avp name="Result-Code" code="268" mandatory="must" may-encrypt="no" protected="mustnot" vendor-bit="mustnot"> <type type-name="Enumerated"/> <enum name="DIAMETER_MULTI_ROUND_AUTH" code="1001"/> <enum name="DIAMETER_SUCCESS" code="2001"/>
  • 22. #sf21vus Diameter profile <avp name="Charging-Rule-Name" code="1005" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <type type-name="OctetString"/> </avp> <avp name="Event-Trigger" code="1006" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <type type-name="Enumerated"/> <enum name="SGSN_CHANGE" code="0"/> <enum name="QOS_CHANGE" code="1"/> <enum name="RAT_CHANGE" code="2"/> <enum name="TFT_CHANGE" code="3"/> <enum name="PLMN_CHANGE" code="4"/> <enum name="LOSS_OF_BEARER" code="5"/> </avp> In this example <avp starts the a new description name= defines the name that will show in wireshark for the code= defined type-name=“Enumerated = a number value that will later get a name assigned to the value OctetString = A string of octets ie. 0a ff cd bb UTF8String = text if “Enumerated” is defined then <enum name=“what ever” code=“0”/> associates a string with whatever number value is seen. Mandatory, May-encrypt, Protected, Vendor-bit = Not used in wireshark, but refers to the flags in the diameter message
  • 23. #sf21vus Diameter profile <avp name="Charging-Rule-Install" code="1001" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <grouped> <gavp name="Charging-Rule-Definition"/> <gavp name="Charging-Rule-Name"/> <gavp name="Charging-Rule-Base-Name"/> <gavp name="Bearer-Identifier"/> <gavp name="Rule-Activation-Time"/> <gavp name="Rule-Deactivation-Time"/> <gavp name="Resource-Allocation-Notification"/> </grouped> </avp> <avp name="Charging-Rule-Base-Name" code="1004" mandatory="must" may-encrypt="yes" protected="may" vendor-bit="must" vendor-id="TGPP"> <type type-name="UTF8String"/> </avp>
  • 24. #sf21vus GTP • GPRS Tunneling protocol is a IP/UDP based protocol used in GSM, UMTS and LTE core networks. It is used to encapsulate user data when passing through core network and also signaling traffic between various core network entities. • In LTE, version 2 is used for GTP-C and version 1 is used for GTP-U • In our shown LTE network implementation, GTP-v2 is used on S5 and S11 interfaces and GTPv1 is used on S1-U, S5. MME S-GW P-GW HSS PCRF S1-U S11 S6a S5/S8 Gx SGi Internet S1-MME GTP-C GTP-C GTP-U GTP-U
  • 25. #sf21vus GTPv2  Different GTP-C messages are used to manage a Tunnel or to set up the tunnel for GTPv1.  GTP-C does not necessarily tunnel messages, as no payload is carried above GTP-C.  The GTP-C messages are Create Session, Create Bearer, Modify Bearer, Update Bearer, Delete Session, Delete Bearer.
  • 26. #sf21vus GTPv1 • The transport bearer is identified by the GTP-U TEID and the IP address (source TEID, destination TEID, source IP address, destination IP address) • As Bearer is received over a TEID on S1-U at the SGW, the SGW then forwards on a different TEID towards the PGW.
  • 27. #sf21vus GTP • While GTP is stateless the upper level protocols may not be. • GTPv2 should be diagnosed from request to response (or lack there of). • Looking at TCP over GTPv1 holds the best advantages for me. But there are things to look out for! • When you take a capture at the SGW, and PGW. You will see that wireshark shows 3 packets per 1. Then Wireshark will do TCP analysis on 3 packets, and mark all packets (except the first) with some error (retran, ooo) • You’ll also notice that WS will only show the upper most layer IP in the source/Destination field
  • 28. #sf21vus GTP Editcap to remove true duplicate packets. Most useful on S5 interface that leaves SGW, and arrives at PGW. .editcap.exe -w .0001 -I 12 C:temproamingIssue.pcap C:temproamDedup.pcap 153 packets seen, 12 packets skipped with duplicate time window equal to or less than 0.000100000 seconds. Tshark can be used to remove dup’s across multiple GTP peers. S11 -> S5, or S1u->S5->SGi .tshark.exe -r 'C:shareTest_casesPCAPExportedData_1.pcap' -R "!(sctp.chunk_type == 5 || sctp.chunk_type == 4)" -2 -w C:tempnoSctpHeart.pcap For large files use capinfos to determine size, and calculate the size of the chunks that the pcap can be broken up into. Mergecap….. Tools, Tools, Tools, they are there for you.
  • 29. #sf21vus editcap -s 128 superbowl.pcap superbowl_128.pcapng Take a larger trace and slice the packets after byte 128 and save to a new file. This means I won’t get the complete payload, but that is ok in the cases where your troubleshooting packet loss using TCP analysis. You can always go back to the original trace file if you need the payload. This will dramatically reduce the size of a trace. Split a large file into many smaller ones. editcap -c <number of packets per file> superbowl.pcap smallSuperbowl.pcap Becomes smallSuperbowl_0000.pacp _0001.pcap, smallSuperbowl_0000.pacp _0002.pcap, etc. Slicing packets in large traces file to reduce the file size
  • 30. #sf21vus Recommend doing this before deduping packets. tshark.exe -r 4perToBeDeduped.pcap -T fields -e tcp.seq_raw | sort | uniq -c 4 1000461189 4 1218696134 4 1218697032 4 1218698412 4 1218699792 4 1218701172 1 2689484057 1 2689485425 1 2689486793 1 2689488161 4 2710474120 4 2710476617 4 2746774803 -T <def> = defines output type (fields, text, ps). When using –e this MUST be <fields> -e <field> = which field to print. Must be repeated print multiple fields Verify each packet has hit every tap
  • 31. #sf21vus IMS / Volte Volte is really nothing more that SIP/RTP (VoIP) over LTE with a guaranteed bearer and more favorable DSCP markers on the packet. Most tools for SIP will work with trouble shooting Volte
  • 32. #sf21vus A quick view into the nature, and timing of RTP packets. Knowing your RTP timers help when using these tools. Example; I know in this case active conversation packets are 20ms, and silent packets are 160ms RTP Stream Analysis
  • 33. #sf21vus IO Graph for jitter/packet arrival 1. Find all RTP streams in the capture. 2. Pick one side of the stream you are looking for, then click “Find Reverse”. 3. Click “Prepare Filter”. 4. Go back to Wireshark main screen, and click the arrow in the display filter portion, to execute the filtering of the streams.
  • 34. #sf21vus CTRL-V or Left side of conversation filter To get display filter expression  Open IO Graph  We know RTP active packet time is 20ms, so we’ll set interval to 1ms.  Our Y field will be udp.time_delta which will give us time of arrival delta between each packet that matches our display filter
  • 35. #sf21vus Left graph depicts what we expect to see. That is 20ms time on active packets, and 160ms on silent packets. Using this graph you can tell who was speaking during this conversation. Right graph is showing the Caller with an active call time at 40ms instead of 20ms, with spikes down to 0ms. Hmm.
  • 36. #sf21vus Set time format to “seconds since previous displayed packet” Adjust display filter to just show caller. We can now see that the caller sends 2 packets every 40ms. That is one at the 40ms mark, then another one within the same sub- millisecond. ?? This was found to be uplink packet time scheduling on the eNodeB. Packets could only be requested on the 40ms timeslot. So UE would send 2 at a time.
  • 37. #sf21vus 4G to 5G What was combined functions on 4G have now been separated, and segregated into their own network functions Functions are now treated like services, and can be called upon with API like queries.
  • 38. #sf21vus •Authentication Server Function (AUSF) acts as an authentication server. (part of HSS from EPC world) •Unified Data Management (UDM) supports: generation of Authentication and Key Agreement (AKA) credentials, user identification handling, access authorization, subscription management. (part of HSS functionality from EPC world) •Application Function (AF) supports: application influence on traffic routing, accessing NEF, interaction with policy framework for policy control. (same as AF in EPC world) •Network Exposure function (NEF) supports: exposure of capabilities and events, secure provision of information from external application to 3GPP network, translation of internal/external information. (not present in EPC world) •NF Repository function (NRF) supports: service discovery function, maintains NF profile and available NF instances. (not present in EPC world) •Network Slice Selection Function (NSSF) supports: selecting of the Network Slice instances to serve the UE, determining the allowed NSSAI, determining the AMF set to be used to serve the UE. (not present in EPC world) •Access and Mobility Management function (AMF) supports: Termination of NAS signaling, NAS ciphering & integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management. (AMF has part of the MME functionality from EPC world) •Session Management function (SMF) supports: session management (session establishment, modification, release), UE IP address allocation & management, DHCP functions, termination of NAS signaling related to session management, DL data notification, traffic steering configuration for UPF for proper traffic routing. (SMF has part of the MME and PGW functionality from EPC world) •User plane function (UPF) supports: packet routing & forwarding, packet inspection, QoS handling, acts as external PDU session point of interconnect to Data Network (DN), and is an anchor point for intra- & inter-RAT mobility. (UPF has part of the SGW & PGW functionality from EPC world) •Policy Control Function (PCF) supports: unified policy framework, providing policy rules to CP functions, access subscription information for policy decisions in UDR. (PCF has part of the PCRF functionality from EPC world) NETWORK FUNCTIONS
  • 39. #sf21vus User plane protocols unchanged The highlighted part still uses GTP, like the previous 4G slides
  • 40. #sf21vus S1AP has changed to NGAP, but is the same type of informational elements, just more Also is still on top of SCTP RAN Signaling
  • 41. #sf21vus Core signaling over http2 • 4G diameter interfaces have now become JSON over HTTP2 (API like queries) • Multihome is now handled by NRF for querying control plane nodes for use.
  • 42. #sf21vus HTTP2 information • Must have wireshark 3.4 or greater • Decode As: HTTP2 content type in stream, enter value, and set as JSON • Currently must be done for each stream ID
  • 43. #sf21vus JSON over HTTP2 Current WS versions require you to filter like this This is not great, because it doesn’t match a key value pair. So any key with a value of “ACTIVATING” could be matched, as long as the key upCnxState exist. Development version allows for absolute filters While this allows for more exact filtering, there is still work to be done.