I would like to filter an existing pcap to produce anything that happens in an LTE connection with a phone. What filter should I use to do this? I know there are sub-layers/display filters such as MAC-LTE, PDCP-LTE, etc. but I want all layers/filter types that occur during an LTE transmission. Is there any way to do this? I already know how to filter the data using tshark, I just need the right filter is all. asked 02 Mar '16, 10:23  Midimistro |
One Answer:
Are you looking for protocols used on the air interface between an eNB and a UE? If yes, the involved protocols are the following display filters: mac-lte, rlc-lte, pdcp-lte, lte_rrc, nas-eps. If you are capturing in network, you could also be interested by the following display filters: s1ap, x2ap, gtp, gtpv2,... If you use a proprietary solution to capture packets, you might have other dissectors (and thus display filters) on top of the ones I listed above (that are part of the standard Wireshark source code). answered 03 Mar '16, 00:52  Pascal Quantin |
