Pre-Tuned Telecom Protocol Dissection

Tool ConfigurationPre-configured

Overview & Purpose

Standard Wireshark installations display packet captures using generic IP and TCP columns that hide crucial telecom headers. TelcoChisel includes pre-configured Wireshark and TShark profiles optimized specifically for telecom security audits. The profile features dedicated columns for GSMTAP radio burst types, 3GPP 5G NAS message names, NGAP/S1AP procedure codes, Diameter Command Codes, and GTP TEID values.

Verification Command

Run the following to confirm this configuration is active on your system:

Pre-Tuned Telecom Protocol Dissection — Verification
tshark -G protocols | grep -E 'gsm|nas_5gs|s1ap|ngap'

Configuration Details & Steps

TelcoChisel applies these settings automatically at ISO build time. The following steps document each configuration item:

  1. 1
    Verify telecom protocol dissection engine capabilities in TShark: tshark -G protocols | grep -E 'gsm|nas_5gs|s1ap|ngap|diameter'
  2. 2
    Capture and extract 5G NAS Registration messages on live interfaces: tshark -i any -Y 'nas_5gs' -T fields -e frame.time -e nas_5gs.mm.message_type
  3. 3
    Filter and inspect GSMTAP air interface signaling from local SDR simulations: tshark -i lo -f 'udp port 4729' -Y 'gsm_a.dtap || lte_rrc'
  4. 4
    Launch Wireshark using the pre-tuned TelcoSec profile: wireshark -k -i lo

Troubleshooting

Common Issues
If Wireshark does not show decoded 5G NAS or Diameter fields, ensure the capture interface is receiving the expected transport port (e.g. UDP 4729 for GSMTAP, SCTP 38412 for 5G NGAP, TCP/SCTP 3868 for Diameter). Use 'Decode As' to bind custom ports to the target dissector.

Frequently Asked Questions

What is GSMTAP?

GSMTAP is an encapsulation protocol that wraps cellular radio interface frames (GSM Um, LTE Uu, 5G NR) inside standard UDP packets on port 4729, allowing Wireshark to dissect over-the-air radio signaling.

How do srsRAN and Open5GS interact with Wireshark?

srsRAN eNodeB/gNodeB transmits live GSMTAP streams to 127.0.0.1:4729, while Open5GS core network functions exchange standard NGAP/S1AP signaling over SCTP on local or physical network interfaces.

Can TShark extract decrypted NAS payloads from PCAPs?

Yes. When provided with the 5G NAS ciphering/integrity keys or when analyzing unencrypted initial registration requests, TShark fully parses the Plaintext NAS protocol elements.

HANDS-ON TELECOM LABS

Learn Pre-Tuned Telecom Protocol Dissection in TelcoSec Academy

Master real-world implementation, protocol fuzzing, and telecom security engineering in guided browser sandbox labs.

Interactive Cloud Labs No Hardware Required CTSP Certification
Start Telecom Labapp.telcosec.net · Instant access
Back to OS Customizations