MiniCore interfaces and how to capture the interfaces traffic

MiniCore is designed as a test Core Network in a single box/server. This means that Yate equipment needed in a Core Network is already installed and preconfigured:

LTE Core – YateUCN as MME, SGW, PGW, PCEF

GSM/GPRS Core – YateUCN as MSC/VLR, GMSC, SGSN, GGSN

YateHSS/HLR as HSS and HLR

YateSMSC as SMSC

YateSTP and YateDRA as STP and DRA

S1AP interface

Standard interface where eNodeBs connect to the Core Network?

YateUCN (more exactly, the MME function) waits for an eNodeB equipment (SatSite/LTE LabKit/Other vendor eNodeB) connection over S1AP protocol:

S1AP listens on IP: 10.0.4.1 of the MiniCore and eNodeB issues the connection from IP 10.0.4.140* (on the LTE LabKit)

* depends on the RAN equipment IP, here yateBTS supposed will be 10.0.4.140 because MiniCore gives IPs from 10.0.4.129/25 network

S5 interface

Internal interface between SGW and PGW

S5 interface listens on IP 10.0.4.2

S8 interface

Standard interface between SGW and PGW when roaming between network operators

S8 interface listens on IP 10.0.4.3, you can see the messages (trafic) from that interface even from YateUCN console: telnet 0 5039, with command: debug ucn_pgw level 9).

S11 interface

Internal interface inside YateUCN

S11 interface trafic can be seen also from UCN console: telnet 0 5039 (with the command: debug ucn_mme_sgsn level 9).

How to capture interfaces traffic inside MiniCore

To capture interfaces trafic inside MiniCore, you can install a tcpdump wrapper called tcpdump-cap.

From linux console, as root type:

urpmi.update Yate;urpmi tcpdump-cap

Edit configuration file with:

vi /etc/tcpdump-cap.conf

Uncomment these lines in the config file:

directory /home/capture

capture ran eth-ran udp port 4729 or udp port 9999 or udp port 23234
capture s1 eth-ran sctp port 36412 or udp port 2123 or udp port 5060 or udp port 2152
capture dra lo sctp port 3868
capture stp lo sctp and not port 3868

Create /home/capture directory with the command:

mkdir /home/capture

In /home/capture directory you will find .pcap files, their name will start in ran, s1, dra and stp. These can be visualized using Wireshark, tshark or any other packet analyzer.

Regarding capture for a certain Subscriber/SIM/IMSI (“IP packet capture for YateUCN PGW/GGSN”), you can use the pcap php script in the YateUCN console with command: pcap add IMSI

Usage: ” pcap {add|del} {IMSI|MSISDN|IMEI|IMEISV}”
” pcap end IP-ADDRESS”
” pcap filter on/off”