How to decode PDCP-LTE?

asked 2019-02-06 23:20:47 +0000

Jeff
1 ●2 ●2 ●2

Based on https://wiki.wireshark.org/PDCP-LTE, packet-pdcp-lte.h, pdcp_lte_logger.c, and the UDP framing format, I wrote 3 PDCP-LTE messages over UDP ports 10000,10001.

And I tried to decode them in Wireshark (2.9.0 and 2.6.6), but failed. 1. PDCP-LTE is not in the drop list (of Decode As ... -> UDP port 10000 -> Current). So I cannot decode UDP port 10000 as PDCP-LTE. 2. I added below config line to Wireshark\decode_as_entries . It seems the below line didn't work and was gnored. decode_as_entry: udp.port,10000,(none),PDCP-LTE

Does anyone know how to enable PDCP-LTE protocol in Wireshark and config it to decode the user data of the specified UDP port number (for example 10000)?

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2019-02-08 16:53:15 +0000

MartinM
197 ●11 ●10

It looks like you need to go to Analyze | Enabled Protocols, find PDCP-LTE, expand it and check pdcp_lte_udp. It is heuristic, so it doesn't matter which UDP port numbers you are using.

edit flag offensive delete link

Comments

Thanks! It worked. The PDCP-LTE, raw PDCP octets, and PDCP payload (IP payload for UP; and LTE-RRC and LTE-NAS for CP) can be decoded well.

Jeff ( 2019-02-12 00:33:12 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-02-06 23:20:47 +0000

Seen: 1,035 times

Last updated: Feb 08 '19

How to decode PDCP-LTE? edit