Hi All,
I have byte codes for 5G RRC Signalling messages in Hex format.
I am trying to import as Hex, then use DLT_USER to decode them, however I get an error when I try to enter nr-rrc as the protocol, saying "dissector not found" - I have tried multiple permutations & combinations.
I'm using v3.6.7.
Any suggestions?
Thanks in advance.
Jeff
(posting this as answer but there's got to be a better way)
The User DLTs Table says "protocol" but it really wants a dissector name.
You can get a list of the current dissectors with Lua.
1. Open the Lua console in the Wireshark Gui - Tools->Lua->Console
2. Open the Lua "REPL" - Tools->Lua->Evaluate, copy in the code below and click Evaluate.
for k,v in pairs(Dissector.list()) do print(k,v) end
The "nr-rrc" entries I get for 3.6.7:
7/28/2022 1:44:30 PM 1021 nr-rrc.bcch.bch 7/28/2022 1:44:30 PM 1022 nr-rrc.bcch.dl.sch 7/28/2022 1:44:30 PM 1023 nr-rrc.cg_configinfo 7/28/2022 1:44:30 PM 1024 nr-rrc.dl.ccch 7/28/2022 1:44:30 PM 1025 nr-rrc.dl.dcch 7/28/2022 1:44:30 PM 1026 nr-rrc.pcch 7/28/2022 1:44:30 PM 1027 nr-rrc.radiobearerconfig 7/28/2022 1:44:30 PM 1028 nr-rrc.rrc_reconf 7/28/2022 1:44:30 PM 1029 nr-rrc.rrc_reconf_msg 7/28/2022 1:44:30 PM 1030 nr-rrc.sbcch.sl.bch 7/28/2022 1:44:30 PM 1031 nr-rrc.scch 7/28/2022 1:44:30 PM 1032 nr-rrc.ue_capabilityrat_containerlist 7/28/2022 1:44:30 PM 1033 nr-rrc.ue_mrdc_cap 7/28/2022 1:44:30 PM 1034 nr-rrc.ue_mrdc_cap_msg 7/28/2022 1:44:30 PM 1035 nr-rrc.ue_nr_cap 7/28/2022 1:44:30 PM 1036 nr-rrc.ue_nr_cap_msg 7/28/2022 1:44:30 PM 1037 nr-rrc.ue_radio_access_cap_info 7/28/2022 1:44:30 PM 1038 nr-rrc.ue_radio_paging_info 7/28/2022 1:44:30 PM 1039 nr-rrc.ul.ccch 7/28/2022 1:44:30 PM 1040 nr-rrc.ul.ccch1 7/28/2022 1:44:30 PM 1041 nr-rrc.ul.dcch 7/28/2022 1:44:30 PM 1042 nr-rrc.ul.dcch_msg_msg
Thanks for your reply Chuck - it's most helpful and I got some messages decoded this way.
Yes agree with your "There's got to be a better way" - this means that I either need to a) have each message in a separate trace since the DLT_USER decode doesn't do the entire RRC protocol suite, rather I need to do it per message, or b) Set a different DLT_USER value for each RRC message type.
I'll play around with trying to add some dummy MAC layer headers to the data and see if I can get Wireshark to decode.
Asked: 2022-07-28 03:44:06 +0000
Seen: 881 times
Last updated: Jul 28 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
