Can anyone help me out with how to filter EPLMN related data. as we are 3G providers to an operator and he is facing "R" symbol issue while latching onto our network. We have wireshark traces but not able to filter EPLMN related parameters to check if our MSS is sending EPLMN data or not. asked 01 May '15, 02:07  Surya |
One Answer:
If an EPLMN list is being presented, it would be in the NAS messaging in the MSC's acceptance of the CS attach or location area update. What exactly do you have a packet capture of (Iu/A, IuB, Air)? answered 02 May '15, 08:59  Quadratic |
I have a normal wireshark trace captured from MSS in which the subscriber was latched.
So to be clear, you have a RANAP packet capture of Iu control to an RNC, when the subscriber is moving to a roaming network with an active location area update, and you want to confirm where the EPLMN info would be if it was there to be found?
If not encrypted (as NAS at this level often is), the location update answer from the MSC would have an EPLMN list if one was to be included. Does that answer your question?
no because I myself want to filter it in the traces and want to prove the seeker operator with the help of evidences that the EPLMN parameter are being sent from MSS.
I'm confused. :)
You have the trace file, you have the location update accept message, and you want to look at it to see if it contained an EPLMN list. So, what is it that you are unable to do or need assistance with?
For filtering for the one subscriber, I'd start in Wireshark by going to Edit > Preferences > Protocols > SCCP and making sure "Trace Associations" is checked. After that, search on the subscriber IMSI (assuming it's contained in the trace, eg: in an identification request/response exchange). Then, from that take the SCCP association and search on that for the dialogue of the location update. Finally check the location update accept for an EPLMN list.
Also try filter "gsm_map.ms.eplmn_List". Again you never did confirm what type of trace this was, so depending on what state the message is in in your trace (eg: encrypted) that may or may not display anything.