wireshark tutorial sniff network traffic

If you launched your GSM network on the basis of two OsmocomBB-compatible phones, as indicated in the previous article, you can transfer GSMTAP packets from OsmoBTS to Wireshark and thus study the network. However, when using OsmocomBB, a phone with a SIM card and the mobile application, you know your Kc encryption key and you can view all your traffic in the clear, transmitted via the Um interface (radio interface) in Wireshark, and learn how real cellular networks work. Using the SDR device as a receiver, you can study the data transmitted on public CCCH channels, unless you know the Kc - session encryption key. To study GSM traffic, you must first record it somehow. But using the GSMTAP filter will allow you to view all GSM Um traffic, since all other headers are embedded in GSMTAP. In addition to the GSMTAP filter, you can use other filters starting with gsm, for example gsm_sms, to search for SMS messages in traffic. All this is sent to the specified IP address in UDP packets (in our case, loopback).Run Wireshark to listen to the loopback interface and set filters to see only GSM Um traffic.Īpplications that can generate GSMTAP traffic for Wireshark usually operate as follows: GSM protocols will be encapsulated in UDP packets with the GSMTAP header when transmitted via the Um interface or in TCP packets with OML, RSL headers when tracing the A-bis interface. The only thing that needs to be set for the LAPD protocol is Use GSM SAPI values. To correctly display GSM protocols in the latest versions of Wireshark, you do not need to install any additional dissectors. Practical examples of attacks inside a GSM network Īnalyzing GSM network traffic in Wireshark I recommend that you read the first if you want to get more opportunities for practice.įor work, we need an osmocom-bb compatible phone capable of receiving a signal on GSM frequencies, for Russia it is 900 MHz and 1800 MHz and a computer with the installed Wireshark sniffer. The second article will be devoted to working with GSM traffic in Wireshark.

Wireshark tutorial sniff network traffic