1.
LTE L13 Protocols
and Procedures
Using Wireshark to view L2

2.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-1
Wireshark Traces
MME
SGW/PGW
eNodeB
eNodeB
NAS, S1AP, X2AP, GTP-C (GTP-v2) and GTP-U
NAS, RRC, PDCP, RLC and MAC*
*RBS MAC or RLC logs
converted to pcap files

3.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-2
RBS Trace File Conversion
frame4Wireshark Pearl Script adds necessary information for Wireshark to
decode the logs.
Eg Whether a MAC-PDU is for a C-RNTI, SI-RNTI, RA-RNTI or P-RNTI
Eg Whether a RLC-PDU is in AM, TM or UM.
frame4Wireshark.pl
text2pcap which is installed with Wireshark
encapsulates MAC/RLC frames inside
UDP so they can be read by Wireshark.
text2pcap

4.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-3
WireShark Settings
Click to
open

5.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-4
MAC-LTE

6.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-5
RLC-LTE

7.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-6
PDCP-LTE

8.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-7
PDCP Control PDU Format
PDCP Control: ROHC feedback
...
Interspersed ROHC feedback packet
D/C PDU Type R R
R R Oct 1
Oct 2
PDCP Control: STATUS Report
...
Bitmap 1 (optional)
D/C PDU Type
BitmapN (optional )
FMS (cont.)
FMS Oct 1
Oct 2
Oct 3
Oct 2+N
D/C Data/Control
FMS First Missing PDCP SN
ROHC RObust Header Compression
PDCP PDU on Wireshark
Oct 1
Oct 2
Oct N
Oct N-1
Oct N-2
Oct N-3
...
Data
PDCP SN
R R R
MAC-I
MAC-I (cont.)
MAC-I (cont.)
MAC-I (cont.)
Can you find more examples?

9.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-8
RLC Acknowledged Mode PDU
SO
SO
LSF Oct 3
Oct 4
LI2
E LI2 (if K>=3)
E LI1
LI1
D/C RF P FI E SN
SN
Data
Oct N
Oct 1
Oct 2
Oct 5
Oct 6
Oct 7
...
LIK-1
E LIK-1
E LIK-2
LIK-2
...
Padding
E LIK
LIK Oct [4.5+1.5*K]
Oct [4.5+1.5*K-1]
Oct [4.5+1.5*K-2]
Oct [4.5+1.5*K-3]
Oct [4.5+1.5*K-4]
Oct [4.5+1.5*K+1]
Present if
K >= 3
SO
SO
LSF Oct 3
Oct 4
LI2
E LI2
E LI1
LI1
D/C RF P FI E SN
SN
Data
Oct N
Oct 1
Oct 2
Oct 5
Oct 6
Oct 7
...
LIK
E LIK
E LIK-1
LIK-1
Oct [4+1.5*K]
...
Oct [4+1.5*K-1]
Oct [4+1.5*K-2]
Oct [4+1.5*K+1]
D/C Data/Control
E Extension Field
FI Framing Info
LSF Last Segment Flag
P Poll Bit
RF Resegmentation Flag
SN Sequence Number
SO Segment Offset
RLC Data PDU on Wireshark
Can you find more examples?
D/C RF P FI E SN
SN
Data
...
Oct 3
Oct N
Oct 1
Oct 2

10.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-9
STATUS PDU
NACK_SN
D/C CPT
E1
ACK_SN
ACK_SN
Oct 1
Oct 2
NACK_SN
E1 E2 NACK_SN
NACK_SN
SOstart
SOstart
SOend
SOend
E1 E2
SOend
...
Oct 3
Oct 4
Oct 5
Oct 6
Oct 7
Oct 8
Oct 9
D/C Data/Control
CPT Control PDU Type
E Extension Field
SO Segment Offset
RLC Control PDU on Wireshark
Can you find more examples?
NACK_SN
D/C CPT
E1
ACK_SN
ACK_SN
Oct 1
Oct 2
NACK_SN
E1 E2 NACK_SN
NACK_SN
SOstart
SOstart
SOend
SOend
E1 E2
SOend
...
Oct 3
Oct 4
Oct 5
Oct 6
Oct 7
Oct 8
Oct 9

11.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-10
MAC Sub-header
LCID
R
F L
R/R/E/LCID/F/L sub-header with
7-bits L field
R/R/E/LCID/F/L sub-header with
15-bits L field
R E LCID
R
F L
R E
L
Oct 1
Oct 2
Oct 1
Oct 2
Oct 3
LCID
R
R/R/E/LCID sub-header
R E Oct 1
MAC on Wireshark (1)
Can you find more examples?
1
3
4
5
2
MAC header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
5 sub-headers

12.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-11
MAC Control Elements
Buffer Size
LCG ID Oct 1
Buffer Size #0
Buffer
Size #1
Buffer Size #1 Buffer Size #2
Buffer
Size #2
Buffer Size #3
Oct 1
Oct 2
Oct 3
Short BSR
Long BSR
MAC on Wireshark (2)
Can you find more examples?
Power Headroom
Short BSR

13.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-12
Maintenance of Uplink Time Alignment
› When the UE gets Timing
- Random Access Response
- Piggy Backed together with data
Timing Advance Command
R R Oct1
UE 2
UE 1
Timing Advance Notes
MAC on Wireshark (3)
How many bits?
What is the change here?
6
NTA,new = NTA,old + (TA -31)x16
= NTA,old + (31 -31)x16 = NTA,old (no change)

14.
© Ericsson AB 2013 | Using Wireshark to view L2 | LZU1089103 R2A | Figure 5-13