Ltepa Wireshark Alu

LTEPA
Hemant singh,
EVDO & LTE TOOLS TEAM, IPRC
May 16, 2018
LTEPA (LTE Packet Analyzer)
This tool is used to capture and decode 3GPP/3GPP2 specific
interfaces messages (hex dumps) in easy & understandable format.
The goal of the tool is to empower users to be able to do some

basic trouble shooting, with just a basic understanding of the
messages that are exchanged within the system. The tool will also
help experienced users quickly analyze and debug problems by
al low ing them to di ve i nto the detai l s of the messages .
LTEPA is currently supported for the following three platforms:

 Windows
 Solaris
 Linux
LTEPA is available in two modes :

 GUI mode called LTEPA
 Command line mode called TLTEPA
2 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTEPA installation instructions:
Download link
http://mobility.web.alcatel-lucent.com/~ltetool/ltepa/LtepaInstall.htm
Windows7/ XP:
Download the Windows installer for desired Ltepa package from tools
download page and run it on your system, follow all instruction.
If you plan on capturing live network traffic with ltepa, you will need to also
have WinPcap installed on your system. Without WinPcap, you will only be
able to open saved captured files. To install WinPcap, download the WinPcap
installer and run it. WinPcap_3_0.exe
LTEPA installation instructions (Linux)
Download the compressed tar.gz file onto your system. Uncompress the file
using following command:
gunzip –c {Downloaded tar.gz} | tar xvf -
Then add the {installdir}/bin to your PATH variable, using following

command:
export PATH={installdir}/bin:$PATH
Replace {installdir} with its absolute path, for
Ex: export PATH=/home/ltepauser/ltepa_linux_x64_10_0_2/bin:$PATH
export DISPLAY={vnc full address:port}
cd /home/ltepauser/ltepa_linux_x64_10_0_2/bin
./dopa
Supported Interfaces (LTE)
LTEPA Currently supports the decoding of the following LTE interfaces

(both Dec’08 and Mar’09 standards)
1. S6a Interface
2. S6b Interface
3. S10 Interface
4. S11 Interface
5. Gx Interface
6. Gxc Interface
6. S5 Interface
7. S8 Interface
8. S1-U Interface
Supported Interfaces (LTE) Contd.,
9. S2a Interface
10. STa Interface
11. S101 Interface
12. Cx Interface
13. Rx Interface
14. Sh Interface
15. S1-MME Interface
16. SGi Interface
17. SWx Interface
18. A & Z Interfaces
Supported Interfaces (LTE) Contd.,
18. Lawful intercept (lteli), CALEA
19. NAS
20. ALU Proprietary Header Support
21. LTELI (Verizon)
22. RS10
23. NAS Deciphering
24. SULP/ULP
25. SSH Automatic Decryption
26. S1ap Private Message
27. S103
LTEPA will be enhanced to support remaining interfaces of LTE also.
LTE Interfaces In Detail
S6a Interface
It enables transfer of subscription and authentication data for
authenticating/authorizing user access to the evolved system (AAA
interface) between MME and HSS. Messages supported are
1. Update-Location-Request
2. Update-Location-Answer
3. Authentication-Information-Request
4. Authentication-Information-Answer
5. Insertsubscriber-Data-Request
6. Insertsubscriber-Data-Answer
7. Cancel-Location-Request
8. Cancel-Location-Answer
9. Purge-UE-Request
S6a Interface Continued.,
10. Purge-UE-Answer
11. Notify-Request
12. Notify-Answer
13. Reset-Request
14. Reset-Answer
15. Delete-Subscriberdata-Request
16. Delete-Subscriberdata-Answer
S6b Interface
This interface is between PGW and 3GPP AAA. The diameter transport
for S6b interface will be based on IPv6. Messages supported are
1. Authorize_Authenticate Answer
3. Re-Auth Request
4. Re-Auth Answer
5. Session-Termination-Request
6. Session-Termination-Answer
7. Abort-Session-Request
8. Abort-Session-Answer
S10 Interface
Reference point between MMEs for MME relocation and MME to MME
information transfer. Messages supported are
1. Identification Request
2. Identification Response
3. Context Request
4. Context Response
5. Context Acknowledge
6. Forward Relocation Request
7. Forward Relocation Response
8. Forward Relocation Complete Notification

9. Forward Relocation Complete Acknowledge
10. Forward Access Context Notification

S10 Interface Contd.,
11. Forward Access Context Acknowledge
12. Relocation Cancel Request
13. Relocation Cancel Response
14. Configuration Transfer Tunnel
S11 Interface
This is reference point between MME and SGW. Messages supported
are
1. Echo Request
2. Echo Response
3. Create Session Request
4. Create Session Response

5. Modify Bearer Request
6. Modify Bearer Response

7. Delete Session Request
8. Delete Session Response
9. Change Notification Request
10. Change Notification Response

11. Modify Bearer Command
12. Modify Bearer Failure Indication
13. Delete Bearer Command
14. Delete Bearer Failure Indication
15. Bearer Resource Command
16. Bearer Resource Failure Indication
17. Downlink Data Notification Failure Indication

18. Trace Session Activation
19. Trace Session Deactivation
20. Stop Paging Indication
21. Create Bearer Request
22. Create Bearer Response
23. Update Bearer Request

24. Update Bearer Response
25. Delete Bearer Request
26. Delete Bearer Response
27. Create Forwarding Tunnel Request
28. Create Forwarding Tunnel Response
29. Suspend Notification
30. Suspend Acknowledge
31. Resume Notification
32. Resume Acknowledge

33. Create Indirect Data Forwarding Tunnel Request
34. Create Indirect Data Forwarding Tunnel Response
35. Delete Indirect Data Forwarding Tunnel Request
36. Delete Indirect Data Forwarding Tunnel Response
37. Release Access Bearers Request
38. Release Access Bearers Response
39. Downlink Data Notification
40. Downlink Data Notification Acknowledgement

41. Update Bearer Complete
Gx Interface
This is reference point between PDN-GW -to- PCRF. Gxc is used

between SGWs and PCRFs when PMIP is used between SGWs and
PGWs. From a functional viewpoint Gxc enables BBERF to PCRF
interworking when s5/s8 use PMIP. Messages supported are
1. CC-Request
2. CC-Answer
3. Re-Auth-Request
4. Re-Auth-Answer
Gxc Interface
This is used between SGWs and PCRFs when PMIP is used between
SGWs and PGWs. From a functional viewpoint Gxc enables BBERF to
PCRF interworking when s5/s8 use PMIP. Messages supported are
1. CC-Request
2. CC-Answer
3. Re-Auth-Request
4. Re-Auth-Answer
S5 Interface
It provides user plane tunneling and tunnel management between

SGW and
PDN GW.
1. Proxy Binding Update
2. Proxy Binding Acknowledgement
3. PrBinding Revocation Indication
4. Binding Revocation Acknowledgement
S8 Interface
It provides user plane tunneling and tunnel management between

SGW and PDN GW.
1. Proxy Binding Update

2. Proxy Binding Acknowledgement
3. PrBinding Revocation Indication
4. Binding Revocation Acknowledgement
S1-U Interface
Reference point between EUTRAN and SGW for the per-bearer user
plane tunneling and inter-eNB path switching during handover. The
transport protocol over this interface is GPRS Tunneling Protocol-User
plane (GTP-U).
1.Echo Request
2. Echo Response
3. Error Indication
4. G-PDU
STa Interface
Message flows for the various interactions between HSGW and 3GPP
AAA for subscriber management. The transport for STa interface will
be based on IPv6.
1. Diameter EAP Request
2. Diameter EAP Response
3. Re-Auth Request
4. Re-Auth Answer
9. Authorize_Authenticate Request

S101 Interface
The S101 reference point is defined between the MME and the HRPD
access, enabling interactions between E-UTRAN Access and
cdma2000 HRPD Access.
1. Echo Request
2. Echo Response
3. Version Not Supported Indication
4. Direct Transfer Request message
5. Direct Transfer Response message
6. Notification Request message
7. Notification Response message
Cx Interface
The interactions between the HSS (Home Subscriber Server) and the
CSCF (Call Session Control Functions), referred to as the Cx interface.
1. User-Authorization-Request
2. User-Authorization-Answer
3. Server-Assignment-Request
4. Server-Assignment-Answer
5. Location-Info-Request
6. Location-Info-Answer
7. Multimedia-Auth-Request
8. Multimedia-Auth-Answer
9. Registration-Termination-Request
10. Registration-Termination-Answer
Rx Interface
The Rx reference point is used to exchange application level session

information between the Policy and Charging Rules Function (PCRF)
and the Application Function (AF).
3. Re-Auth Request
4. Re-Auth Answer
Sh Interface
The interactions between the HSS (Home Subscriber Server) and the
SIP AS (Application Server) and between the HSS and the OSA SCS
(Service Capability Server). Messages supported are
1. User-Data-Request
2. User-Data-Answer
3. Profile-Update-Request
4. Profile-Update-Answer
5. Subscribe-Notifications-Request
6. Subscribe-Notifications-Answer
7. Push-Notification-Request
8. Push-Notification-Answer
S1-MME Interface
Reference point for the control plane protocol between EUTRAN and
MME. The protocol over this reference point is eRANAP and it uses
Stream Control Transmission Protocol (SCTP) as the transport
protocol.
1. HandoverPreparation
2. HandoverResourceAllocation
3. HandoverNotification
4. PathSwitchRequest
5. HandoverCancel
6. RABSetup
7. RABModify
8. RABRelease
9. RABReleaseIndication
10. InitialContextSetup
S1-MME Interface Contd.,
11. Paging
12. downlinkNASTransport
13. initialUEMessage
14. uplinkNASTransport
15. Reset
16. ErrorIndication
17. NASNonDeliveryIndication
18. S1Setup
19. UEContextReleaseRequest
20. DownlinkS1cdma2000tunneling
21. UplinkS1cdma2000tunneling
22. UEContextModification
23. UECapabilityInfoIndication
24. UEContextRelease
25. eNBStatusTransfer
26. MMEStatusTransfer
27. DeactivateTrace
28. TraceStart
29. TraceFailureIndication
30. ENBConfigurationUpdate
31. MMEConfigurationUpdate
32. LocationReportingControl
33. LocationReportingFailureIndication
34. LocationReport
35. OverloadStart
36. OverloadStop
37. WriteReplaceWarning
38. eNBDirectInformationTransfer
39. MMEDirectInformationTransfer
40. PrivateMessage
SGi Interface
SGi is the reference point between the PDN GW and the packet data
network. Packet data network may be an operator-external public or
private packet data network or an intra-operator packet data
network, e.g. for provision of IMS services. Messages supported are
3. Accounting-Request
4. Accounting-Answer
SWx Interface
The SWx reference point between the 3GPP AAA Server and the HSS.
The SWx reference point is used to authorize the UE and to transport
PMIPv6 related mobility parameters in the chained tunnel cases.
Messages supported are
1. Multimedia-Authentication-Request (MAR) command
2. Multimedia-Authentication-Answer (MAA) command

3. Push-Profile-Request -Request (PPR) command
4. Push-Profile-Answer (PAA) command
5. Server-Assignment-Request (SAR) command
6. Server-Assignment-Answer (SAA) command
7. Registration-Termination-Request (RTR) command

8. Registration-Termination-Answer (RTA) command
What’s new in LTEPA?
Present LTEPA (version 10.0.2) is based on latest stable Wireshark
version 1.8.1
LTEPA supports all interface messages of LTE (3GPP standards) and

few interfaces of VOLGA Configuration.
 LTEPA Tools page provide Windows7/XP/Linux (v10/11) versions of

LTEPA LTE standards up to Dec’12.
http://mobility.web.alcatel-lucent.com/~ltetool/ltepa/LTEPA.html
http://mobility.web.alcatel-lucent.com/~ltetool/ltepa/TLTEPA.html
New Features Supported in LTEPA
 FID LS30000-01 (LTE Enhancements to support DEC 2011 S11
Standards )
 LTEPA is fully compliant for DEC’11 Standards for R10 at
present.
 LTEPA is fully compliant for Dec’12 Standards for R11.
LTEPA Monitoring in LTE-NLT Lab Network
Filtering expressions for LTE Interfaces
S6a -> s6a
S1-MME -> s1ap
Gx -> gx
Gxc -> gxc
S5/S8 -> s5_s8
S11,S10,S101, S2a, S103 -> gtpv2

STa -> sta
S2a -> s2a

S6b -> s6b
SGi -> sgi
Rx -> rx
Sh -> sh
Filtering expressions for LTE Interfaces Contd.,
Capturing of messages over an interface
Capturing messages over an interface Contd.,
Save the captured file
Open the saved Capture file (Debugging offline)
Filtering of fields in a message
Preferences setup for S1AP and X2AP
interfaces
interfaces Contd.,
interfaces Contd.,
interfaces Contd.,
Flow Graph option in LTEPA
NAS-EPS Deciphering Technique
Following things involved to make NAS-EPS deciphering from plain ciphered

message.
1. get RAND and AUTH value from S1ap/NAS Authentication Request

2. get MCC, MNC value from S1ap/NAS Attach Request Message.
3. get Kasme value from S6a Authentication-InformationAnswer(318).
Open Ediit->Preferences->Protocols->NAS
select Enable NAS Decipher
apply all required value in respective box.
select Apply->OK
Note:- s6a Authentication-information message should be present in pcap file

to work decipher algorithm automatically in LTEPA
NAS Decipering
LTELI Decode Setting
LTEPA support Li message decoding for AT&T and Verizon
Select Edit->Preferences->Protocols->LTELI
Put TCP port number for the message.

By default LTEPA will decode AT&T LTELI messages formate.
Enable non-AT&T if your messages are non AT&T
LTELI Decode Setting
Background
 The LTEPA tool is built on top of the open source ethereal
software for analyzing packet data, which is completely migrated to
Wireshark .
 LTEPA is restricted for use within Alcatel-Lucent only and

can not be shared with customers or other third parties.
For new requirements / issues (Wireshark version), please take out

a RTS (MR/TR) under "EVDO Tools Support Team > DOPA" .
 The complete documentation for the installation and the usage of

LTEPA is available on the EVDO Tools web page at the following link
 http://classa.ih.lucent.com/~evdotool/dopa.html
Thank You

Ltepa Wireshark Alu

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Ltepa Wireshark Alu

Hochgeladen von

Copyright:

Verfügbare Formate

LTEPA

The goal of the tool is to empower users to be able to do some

LTEPA is currently supported for the following three platforms:

LTEPA is available in two modes :

Then add the {installdir}/bin to your PATH variable, using following

Replace {installdir} with its absolute path, for

Ex: export PATH=/home/ltepauser/ltepa_linux_x64_10_0_2/bin:$PATH

export DISPLAY={vnc full address:port}

LTEPA Currently supports the decoding of the following LTE interfaces

10. STa Interface

11. S101 Interface

16. SGi Interface

17. SWx Interface

18. A & Z Interfaces

18. Lawful intercept (lteli), CALEA

20. ALU Proprietary Header Support

21. LTELI (Verizon)

25. SSH Automatic Decryption

26. S1ap Private Message

6. Forward Relocation Request

7. Forward Relocation Response

8. Forward Relocation Complete Notification

10. Forward Access Context Notification

11. Forward Access Context Acknowledge

12. Relocation Cancel Request

13. Relocation Cancel Response

14. Configuration Transfer Tunnel

3. Create Session Request

4. Create Session Response

6. Modify Bearer Response

8. Delete Session Response

9. Change Notification Request

10. Change Notification Response

13. Delete Bearer Command

14. Delete Bearer Failure Indication

15. Bearer Resource Command

16. Bearer Resource Failure Indication

17. Downlink Data Notification Failure Indication

20. Stop Paging Indication

21. Create Bearer Request

22. Create Bearer Response

23. Update Bearer Request

25. Delete Bearer Request

26. Delete Bearer Response

27. Create Forwarding Tunnel Request

28. Create Forwarding Tunnel Response

29. Suspend Notification

30. Suspend Acknowledge

31. Resume Notification

32. Resume Acknowledge

34. Create Indirect Data Forwarding Tunnel Response

35. Delete Indirect Data Forwarding Tunnel Request

36. Delete Indirect Data Forwarding Tunnel Response

37. Release Access Bearers Request

38. Release Access Bearers Response

39. Downlink Data Notification

40. Downlink Data Notification Acknowledgement

This is reference point between PDN-GW -to- PCRF. Gxc is used

It provides user plane tunneling and tunnel management between

2. Proxy Binding Acknowledgement

3. PrBinding Revocation Indication

4. Binding Revocation Acknowledgement

It provides user plane tunneling and tunnel management between

1. Proxy Binding Update