create new tag
, view all tags

WireShark Interface

OAI implements MAC interface for the Wireshark using UDP sockets, which enables Wireshark to disset MAC, RLC, PDCP, RRC (see configuration below). As for the S1AP, GTP packets, no configuratuon is needed. You can also generate PCAP files.

You need to open Wireshark, open the preferences, and check try heuristics for the UDP protocol, MAC-LTE, RLC-LTE, and PDCP-LTE. Then capture for all the interfaces with the following filters: s1ap or lte_rrc or mac-lte or rlc-lte or pdcp-lte. Note the L2 pdus are transmitted to the local interface. An example of LTE packet dissection can be found oai_l2l3.pcap.

Additional configuration can be found below.


  • Wireshark : lte-softmodem -W (option -p for build_oai.bash)
  • Pcap : lte-softmodem -P /tmp/oai.pcap

Example OAISIM

  • Wireshark Control plane only: ./oaisim -a -P wireshark -n 100
  • Pcap control plane only: ./oaisim -a -P pcap-n 100, then open oai_opt.pcap
  • Wireshark Control plane + data plane: ./oaisim -a -T scbr -P wireshark -n 500
  • Pcap Control plane + data plane: ./oaisim -a -T scbr -P pcap -n 500 , then open oai_opt.pcap


RRC: http://wiki.wireshark.org/LTE%20RRC
  • There are currently no preference settings for this protocol.
PDCP: http://wiki.wireshark.org/PDCP-LTE
  • Show User-Plane uncompessed data as IP. Default is Off.
  • Show unciphered Signalling-Plane data as RRC. Default if Off.
  • Attempt to decode ROHC data. Default is Off.
  • Try Heuristic LTE-PDCP over UDP framing. Turn on this feature.
  • Which layer info to show in Info column. Default is RLC.
  • PDCP UE security keys. A table of (UEId, RRCKey, UPKeys) entries.
  • Attempt to decipher Signalling (RRC) SDUs. Turn on this feature.
  • Attempt to decipher User-plane (IP) SDUs. Default is Off.
RLC: http://wiki.wireshark.org/RLC-LTE
  • Do sequence analysis for AM channels. Can be done for either standalone RLC frames, or those found inside MAC frames. Default is OFF.
  • Do sequence analysis for UM channels. Can be done for either standalone RLC frames, or those found inside MAC frames. Default is OFF.
  • Call PDCP dissector for SRB PDUs. Turn on this feature.
  • Call RRC dissector for CCCH PDUs. Turn on this feature.
  • Try heuristic LTE-RLC framing over UDP. Turn on this feature.
  • May see RLC headers only. Default is OFF.
  • Attempt SDU reassembly. Turn on this feature.. Will not currently work with out-of-order PDUs or resegmentation.
MAC: http://wiki.wireshark.org/MAC-LTE
  • Number of Re-Transmits before expert warning triggered. Default is 3.
  • Attempt to decode BCH, PCH and CCCH data using LTE RRC dissector. Default is TRUE.
  • Dissect frames that have failed CRC check. Default is FALSE.
  • Try Heuristic LTE-MAC framing over UDP. Turn on this feature.
  • Attempt to dissect LCID 1&2 as srb 1&2. Turn on this feature.
  • LCID -> DRB Mappings Table. Can configure data channel ID and RLC mode so that RLC-LTE dissector can be called for these SDUs.
  • Attempt to track UL HARQ resends. When frame marked as reTx, looks for link back to original tx. Default is TRUE.
  • BSR size when warning should be issued. Default is 50 (19325 < BS <= 22624)
  • Track status of SRs within UEs. Looks for and shows links between SR request and resulting grant or failure indication. Default is TRUE. Not implemented
  • Which layer info to show in Info column. Choices are PHY, MAC or RLC info. Default is MAC-info.

ITTI Analyzer

The itti_analyzer tool can be user to analyze the exchanges between RRC<->S1AP, RRC<->PDCP, PDCP<->S1. This needs to be enabled when compiling either oaisim or lte-softmodem using the flag ITTI_ENABLED.

The itti_analizer requires libgtk-3-0 to be installed:

sudo apt-get install libgtk-3-0

The itti_analyzer itself is located in common/utils/itti_analyzer and can be installed using

autoreconf -fi && ./configure && make && sudo make install

Decoding Problem

For those having a problem on decoding the "oai_opt.pcap" file using
wireshark, especially running with "oaisim -P pcap".

Please do the following:
Step 1:
Edit -> Configuration Profiles -> New
Name as MAC-LTE

Step 2:
Edit -> Preferences -> Protocols -> DLT_USER -> Encapsulations Table
-> New -> User 0 (DLT=147)
Payload Protocol: mac-lte-framed

-- NavidNikaein - 24 Mar 2015

-- ChunYeowYeoh - 22 Oct 2015

Topic attachments
I Attachment Action Size Date Who Comment
Unknown file formatpcap oai_l2l3.pcap manage 260.8 K 27 Mar 2015 - 17:49 NavidNikaein OAI wireshark capture
Topic revision: r11 - 22 Oct 2015 - ChunYeowYeoh
Copyright 2004-2010 Institut Eurecom & all contributing authors.