Sei sulla pagina 1di 54

LTEPA

Hemant singh,
EVDO & LTE TOOLS TEAM, IPRC
May 16, 2018
LTEPA (LTE Packet Analyzer)
This tool is used to capture and decode 3GPP/3GPP2 specific
interfaces messages (hex dumps) in easy & understandable format.

The goal of the tool is to empower users to be able to do some


basic trouble shooting, with just a basic understanding of the
messages that are exchanged within the system. The tool will also
help experienced users quickly analyze and debug problems by
al low ing them to di ve i nto the detai l s of the messages .

LTEPA is currently supported for the following three platforms:


 Windows
 Solaris
 Linux

LTEPA is available in two modes :


 GUI mode called LTEPA
 Command line mode called TLTEPA

2 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTEPA installation instructions:

Download link

http://mobility.web.alcatel-lucent.com/~ltetool/ltepa/LtepaInstall.htm

Windows7/ XP:
Download the Windows installer for desired Ltepa package from tools
download page and run it on your system, follow all instruction.

If you plan on capturing live network traffic with ltepa, you will need to also
have WinPcap installed on your system. Without WinPcap, you will only be
able to open saved captured files. To install WinPcap, download the WinPcap
installer and run it. WinPcap_3_0.exe

3 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTEPA installation instructions (Linux)

Download the compressed tar.gz file onto your system. Uncompress the file
using following command:
gunzip –c {Downloaded tar.gz} | tar xvf -

Then add the {installdir}/bin to your PATH variable, using following


command:
export PATH={installdir}/bin:$PATH

Replace {installdir} with its absolute path, for

Ex: export PATH=/home/ltepauser/ltepa_linux_x64_10_0_2/bin:$PATH

export DISPLAY={vnc full address:port}

cd /home/ltepauser/ltepa_linux_x64_10_0_2/bin
./dopa

4 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Supported Interfaces (LTE)

LTEPA Currently supports the decoding of the following LTE interfaces


(both Dec’08 and Mar’09 standards)

1. S6a Interface
2. S6b Interface

3. S10 Interface

4. S11 Interface

5. Gx Interface

6. Gxc Interface

6. S5 Interface

7. S8 Interface
8. S1-U Interface

5 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Supported Interfaces (LTE) Contd.,

9. S2a Interface

10. STa Interface

11. S101 Interface

12. Cx Interface

13. Rx Interface
14. Sh Interface
15. S1-MME Interface

16. SGi Interface

17. SWx Interface

18. A & Z Interfaces

6 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Supported Interfaces (LTE) Contd.,

18. Lawful intercept (lteli), CALEA

19. NAS

20. ALU Proprietary Header Support

21. LTELI (Verizon)

22. RS10
23. NAS Deciphering
24. SULP/ULP

25. SSH Automatic Decryption

26. S1ap Private Message

27. S103
LTEPA will be enhanced to support remaining interfaces of LTE also.

7 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTE Interfaces In Detail

8 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S6a Interface
It enables transfer of subscription and authentication data for
authenticating/authorizing user access to the evolved system (AAA
interface) between MME and HSS. Messages supported are
1. Update-Location-Request

2. Update-Location-Answer

3. Authentication-Information-Request

4. Authentication-Information-Answer

5. Insertsubscriber-Data-Request

6. Insertsubscriber-Data-Answer

7. Cancel-Location-Request
8. Cancel-Location-Answer

9. Purge-UE-Request

9 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S6a Interface Continued.,

10. Purge-UE-Answer

11. Notify-Request

12. Notify-Answer

13. Reset-Request

14. Reset-Answer
15. Delete-Subscriberdata-Request
16. Delete-Subscriberdata-Answer

10 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S6b Interface

This interface is between PGW and 3GPP AAA. The diameter transport
for S6b interface will be based on IPv6. Messages supported are

1. Authorize_Authenticate Answer
2. Authorize_Authenticate Answer

3. Re-Auth Request

4. Re-Auth Answer

5. Session-Termination-Request

6. Session-Termination-Answer

7. Abort-Session-Request

8. Abort-Session-Answer

11 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S10 Interface

Reference point between MMEs for MME relocation and MME to MME
information transfer. Messages supported are

1. Identification Request
2. Identification Response

3. Context Request

4. Context Response

5. Context Acknowledge

6. Forward Relocation Request

7. Forward Relocation Response

8. Forward Relocation Complete Notification


9. Forward Relocation Complete Acknowledge

10. Forward Access Context Notification


12 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S10 Interface Contd.,

11. Forward Access Context Acknowledge

12. Relocation Cancel Request

13. Relocation Cancel Response

14. Configuration Transfer Tunnel

13 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S11 Interface
This is reference point between MME and SGW. Messages supported
are

1. Echo Request

2. Echo Response

3. Create Session Request

4. Create Session Response


5. Modify Bearer Request

6. Modify Bearer Response


7. Delete Session Request

8. Delete Session Response

9. Change Notification Request

10. Change Notification Response


11. Modify Bearer Command
14 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S11 Interface Contd.,
12. Modify Bearer Failure Indication

13. Delete Bearer Command

14. Delete Bearer Failure Indication

15. Bearer Resource Command

16. Bearer Resource Failure Indication

17. Downlink Data Notification Failure Indication


18. Trace Session Activation
19. Trace Session Deactivation

20. Stop Paging Indication

21. Create Bearer Request

22. Create Bearer Response

23. Update Bearer Request


15 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S11 Interface Contd.,
24. Update Bearer Response

25. Delete Bearer Request

26. Delete Bearer Response

27. Create Forwarding Tunnel Request

28. Create Forwarding Tunnel Response

29. Suspend Notification

30. Suspend Acknowledge

31. Resume Notification

32. Resume Acknowledge


33. Create Indirect Data Forwarding Tunnel Request

34. Create Indirect Data Forwarding Tunnel Response

35. Delete Indirect Data Forwarding Tunnel Request

16 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S11 Interface Contd.,

36. Delete Indirect Data Forwarding Tunnel Response

37. Release Access Bearers Request

38. Release Access Bearers Response

39. Downlink Data Notification

40. Downlink Data Notification Acknowledgement


41. Update Bearer Complete

17 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Gx Interface

This is reference point between PDN-GW -to- PCRF. Gxc is used


between SGWs and PCRFs when PMIP is used between SGWs and
PGWs. From a functional viewpoint Gxc enables BBERF to PCRF
interworking when s5/s8 use PMIP. Messages supported are

1. CC-Request

2. CC-Answer
3. Re-Auth-Request
4. Re-Auth-Answer

18 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Gxc Interface

This is used between SGWs and PCRFs when PMIP is used between
SGWs and PGWs. From a functional viewpoint Gxc enables BBERF to
PCRF interworking when s5/s8 use PMIP. Messages supported are

1. CC-Request

2. CC-Answer

3. Re-Auth-Request

4. Re-Auth-Answer

19 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S5 Interface

It provides user plane tunneling and tunnel management between


SGW and

PDN GW.
1. Proxy Binding Update

2. Proxy Binding Acknowledgement

3. PrBinding Revocation Indication

4. Binding Revocation Acknowledgement

20 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S8 Interface

It provides user plane tunneling and tunnel management between


SGW and PDN GW.

1. Proxy Binding Update


2. Proxy Binding Acknowledgement

3. PrBinding Revocation Indication

4. Binding Revocation Acknowledgement

21 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S1-U Interface

Reference point between EUTRAN and SGW for the per-bearer user
plane tunneling and inter-eNB path switching during handover. The
transport protocol over this interface is GPRS Tunneling Protocol-User
plane (GTP-U).

1.Echo Request

2. Echo Response
3. Error Indication
4. G-PDU

22 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
STa Interface
Message flows for the various interactions between HSGW and 3GPP
AAA for subscriber management. The transport for STa interface will
be based on IPv6.
1. Diameter EAP Request

2. Diameter EAP Response

3. Re-Auth Request

4. Re-Auth Answer

5. Session-Termination-Request

6. Session-Termination-Answer

7. Abort-Session-Request
8. Abort-Session-Answer

9. Authorize_Authenticate Request

10. Authorize_Authenticate Answer


23 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S101 Interface

The S101 reference point is defined between the MME and the HRPD
access, enabling interactions between E-UTRAN Access and
cdma2000 HRPD Access.

1. Echo Request

2. Echo Response

3. Version Not Supported Indication

4. Direct Transfer Request message

5. Direct Transfer Response message

6. Notification Request message

7. Notification Response message

24 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Cx Interface
The interactions between the HSS (Home Subscriber Server) and the
CSCF (Call Session Control Functions), referred to as the Cx interface.

1. User-Authorization-Request

2. User-Authorization-Answer

3. Server-Assignment-Request

4. Server-Assignment-Answer

5. Location-Info-Request

6. Location-Info-Answer

7. Multimedia-Auth-Request

8. Multimedia-Auth-Answer
9. Registration-Termination-Request

10. Registration-Termination-Answer

25 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Rx Interface

The Rx reference point is used to exchange application level session


information between the Policy and Charging Rules Function (PCRF)
and the Application Function (AF).

1. Authorize_Authenticate Request

2. Authorize_Authenticate Answer

3. Re-Auth Request

4. Re-Auth Answer

5. Session-Termination-Request

6. Session-Termination-Answer

7. Abort-Session-Request
8. Abort-Session-Answer

26 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Sh Interface

The interactions between the HSS (Home Subscriber Server) and the
SIP AS (Application Server) and between the HSS and the OSA SCS
(Service Capability Server). Messages supported are

1. User-Data-Request

2. User-Data-Answer

3. Profile-Update-Request

4. Profile-Update-Answer

5. Subscribe-Notifications-Request

6. Subscribe-Notifications-Answer

7. Push-Notification-Request
8. Push-Notification-Answer

27 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S1-MME Interface
Reference point for the control plane protocol between EUTRAN and
MME. The protocol over this reference point is eRANAP and it uses
Stream Control Transmission Protocol (SCTP) as the transport
protocol.
1. HandoverPreparation

2. HandoverResourceAllocation

3. HandoverNotification

4. PathSwitchRequest

5. HandoverCancel

6. RABSetup

7. RABModify
8. RABRelease

9. RABReleaseIndication

10. InitialContextSetup
28 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S1-MME Interface Contd.,
11. Paging

12. downlinkNASTransport
13. initialUEMessage

14. uplinkNASTransport

15. Reset

16. ErrorIndication

17. NASNonDeliveryIndication

18. S1Setup

19. UEContextReleaseRequest
20. DownlinkS1cdma2000tunneling
21. UplinkS1cdma2000tunneling

22. UEContextModification
29 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S1-MME Interface Contd.,
23. UECapabilityInfoIndication
24. UEContextRelease

25. eNBStatusTransfer

26. MMEStatusTransfer

27. DeactivateTrace

28. TraceStart

29. TraceFailureIndication

30. ENBConfigurationUpdate
31. MMEConfigurationUpdate

32. LocationReportingControl

33. LocationReportingFailureIndication

34. LocationReport
30 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
S1-MME Interface Contd.,

35. OverloadStart

36. OverloadStop

37. WriteReplaceWarning

38. eNBDirectInformationTransfer

39. MMEDirectInformationTransfer
40. PrivateMessage

31 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
SGi Interface
SGi is the reference point between the PDN GW and the packet data
network. Packet data network may be an operator-external public or
private packet data network or an intra-operator packet data
network, e.g. for provision of IMS services. Messages supported are
1. Authorize_Authenticate Request

2. Authorize_Authenticate Answer

3. Accounting-Request

4. Accounting-Answer

5. Session-Termination-Request

6. Session-Termination-Answer

7. Abort-Session-Request
8. Abort-Session-Answer

32 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
SWx Interface

The SWx reference point between the 3GPP AAA Server and the HSS.
The SWx reference point is used to authorize the UE and to transport
PMIPv6 related mobility parameters in the chained tunnel cases.
Messages supported are

1. Multimedia-Authentication-Request (MAR) command

2. Multimedia-Authentication-Answer (MAA) command


3. Push-Profile-Request -Request (PPR) command
4. Push-Profile-Answer (PAA) command

5. Server-Assignment-Request (SAR) command

6. Server-Assignment-Answer (SAA) command

7. Registration-Termination-Request (RTR) command


8. Registration-Termination-Answer (RTA) command

33 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
What’s new in LTEPA?
Present LTEPA (version 10.0.2) is based on latest stable Wireshark
version 1.8.1

LTEPA supports all interface messages of LTE (3GPP standards) and


few interfaces of VOLGA Configuration.

 LTEPA Tools page provide Windows7/XP/Linux (v10/11) versions of


LTEPA LTE standards up to Dec’12.
http://mobility.web.alcatel-lucent.com/~ltetool/ltepa/LTEPA.html
http://mobility.web.alcatel-lucent.com/~ltetool/ltepa/TLTEPA.html

34 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
New Features Supported in LTEPA
 FID LS30000-01 (LTE Enhancements to support DEC 2011 S11
Standards )
 LTEPA is fully compliant for DEC’11 Standards for R10 at
present.
 LTEPA is fully compliant for Dec’12 Standards for R11.

35 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTEPA Monitoring in LTE-NLT Lab Network

36 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Filtering expressions for LTE Interfaces
S6a -> s6a

S1-MME -> s1ap

Gx -> gx

Gxc -> gxc

S5/S8 -> s5_s8

S11,S10,S101, S2a, S103 -> gtpv2


STa -> sta

S2a -> s2a


S6b -> s6b
SGi -> sgi
Rx -> rx

Sh -> sh

37 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Filtering expressions for LTE Interfaces Contd.,

38 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Capturing of messages over an interface

39 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Capturing messages over an interface Contd.,

40 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Save the captured file

41 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Open the saved Capture file (Debugging offline)

42 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Filtering of fields in a message

43 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Preferences setup for S1AP and X2AP
interfaces

44 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Preferences setup for S1AP and X2AP
interfaces Contd.,

45 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Preferences setup for S1AP and X2AP
interfaces Contd.,

46 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Preferences setup for S1AP and X2AP
interfaces Contd.,

47 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Flow Graph option in LTEPA

48 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
NAS-EPS Deciphering Technique

Following things involved to make NAS-EPS deciphering from plain ciphered


message.

1. get RAND and AUTH value from S1ap/NAS Authentication Request


2. get MCC, MNC value from S1ap/NAS Attach Request Message.

3. get Kasme value from S6a Authentication-InformationAnswer(318).

Open Ediit->Preferences->Protocols->NAS

select Enable NAS Decipher

apply all required value in respective box.

select Apply->OK

Note:- s6a Authentication-information message should be present in pcap file


to work decipher algorithm automatically in LTEPA

49 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
NAS Decipering

50 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTELI Decode Setting

LTEPA support Li message decoding for AT&T and Verizon

Select Edit->Preferences->Protocols->LTELI

Put TCP port number for the message.


By default LTEPA will decode AT&T LTELI messages formate.
Enable non-AT&T if your messages are non AT&T

51 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
LTELI Decode Setting

52 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Background
 The LTEPA tool is built on top of the open source ethereal
software for analyzing packet data, which is completely migrated to
Wireshark .

 LTEPA is restricted for use within Alcatel-Lucent only and


can not be shared with customers or other third parties.

For new requirements / issues (Wireshark version), please take out


a RTS (MR/TR) under "EVDO Tools Support Team > DOPA" .

 The complete documentation for the installation and the usage of


LTEPA is available on the EVDO Tools web page at the following link

 http://classa.ih.lucent.com/~evdotool/dopa.html

53 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####
Thank You

54 | Presentation Title | Month 2006 All Rights Reserved © Alcatel-Lucent 2006, #####