Wireshark解析PDCP-LTE

老师说，做一点儿就得写一点儿，嗯。就从比较高层的PDCP做起吧~

1. 基本信息get√

读了一篇叫做“LTE协议栈软件分析测试方法”的文章（一搜即得）。启发：可以用以太网代替PHY层，用wireshark来解析高层协议

“通过udpsocket编程来发送MAC层协议数据包，同时将RRC、PD-CP、RLC、MAC层的协议数据包通过udp socket编程抄送至网络封包捕获程序”

再看wireshark关于PDCP的说明，http://wiki.wireshark.org/PDCP-LTE

只支持ROHC负载.

支持从RLC-LTE SDUs、DCT2000 log files、packet-pdcp-lte.h中定义的UDP格式中读取PDCP框架。还给出了一个UDP封装的例子，pdcp_lte_logger.c

Preference Settings

Show User-Plane uncompessed data as IP. Default is Off.

Show unciphered Signalling-Plane data as RRC. Default if Off.

Attempt to decode ROHC data. Default is Off.

Try Heuristic LTE-PDCP over UDP framing. Default is Off.

Which layer info to show in Info column. Default is RLC.

PDCP UE security keys. A table of (UEId, RRCKey, UPKeys) entries.

Attempt to decipher Signalling (RRC) SDUs. Default is Off.
Attempt to decipher User-plane (IP) SDUs. Default is Off.

其实看了http://blog.csdn.net/u011208220/article/details/38131789，就只改了"Try Heuristic LTE-PDCP over UDP framing"这一项，回头可以勾上其他的在试试^^

Try Heuristic LTE-PDCP over UDP framing

2 pdcp_lte_logger.c编译

由于已知这段代码的作用是将PDCP封装到UDP数据包发送给指定服务器，就在扫了一眼代码之后就马上开始尝试编译啦。
原代码中有一句#include "../wireshark/epan/dissectors/packet-pdcp-lte.h"，我也很机智的把wireshark目录改成我的wireshark-1.99.2
但还是出了很多编译错误比如“未知的proto_item类型”，主要是因为pdcp_lte_logger.c包含了packet-pdcp-lte.h,而后者又包含了packet-rohc.h。这两个头文件中都使用了“未知的”类型。这里所说的“未知”，我认为应该是相对于单独编译pdcp_lte_logger.c的情景下。

--------------------so，亲测有效的蠢方法如下--------------------

去掉#include "../wireshark/epan/dissectors/packet-pdcp-lte.h"，但这时编译会报错，因为少了上面说的两个头文件，就有很多未定义的东西，这时候看错误提示什么没定义就去头文件中找到粘贴到pdcp_lte_logger.c
于是，就相当于在pdcp_lte_logger.c中加入了如下代码段，再gcc -g -o test pdcp_lte_logger.c 编译。

//#include "../wireshark-1.99.2/epan/dissectors/packet-pdcp-lte.h"
/* Direction */
#define DIRECTION_UPLINK   0
#define DIRECTION_DOWNLINK 1
/* Signature.  Rather than try to define a port for this, or make the port number a preference, 
frames will start with this string (with no terminating NULL */
#define PDCP_LTE_START_STRING "pdcp-lte"
/* Fixed fields.  This is followed by the following 3 mandatory fields:
   - no_header_pdu (1 byte)
   - plane (1 byte)
   - rohc_compression ( byte)
   (where the allowed values are defined above) */
/* Conditional field. This field is mandatory in case of User Plane PDCP PDU. 
The format is to have the tag, followed by the value (there is no length field, 
it's implicit from the tag). 
The allowed values are defined above. */
#define PDCP_LTE_SEQNUM_LENGTH_TAG          0x02
/* 1 byte */
/* Optional fields. Attaching this info to frames will allow you to show you display/filter/plot/add-custom-columns on these fields, so should be added if available.
The format is to have the tag, followed by the value (there is no length field, it's implicit from the tag) */
#define PDCP_LTE_DIRECTION_TAG              0x03
/* 1 byte */
#define PDCP_LTE_LOG_CHAN_TYPE_TAG          0x04
/* 1 byte */
#define PDCP_LTE_BCCH_TRANSPORT_TYPE_TAG    0x05
/* 1 byte */
#define PDCP_LTE_ROHC_IP_VERSION_TAG        0x06
/* 2 bytes, network order */
#define PDCP_LTE_ROHC_CID_INC_INFO_TAG      0x07
/* 1 byte */
#define PDCP_LTE_ROHC_LARGE_CID_PRES_TAG    0x08
/* 1 byte */
#define PDCP_LTE_ROHC_MODE_TAG              0x09
/* 1 byte */
#define PDCP_LTE_ROHC_RND_TAG               0x0A
/* 1 byte */
#define PDCP_LTE_ROHC_UDP_CHECKSUM_PRES_TAG 0x0B
/* 1 byte */
#define PDCP_LTE_ROHC_PROFILE_TAG           0x0C
/* 2 bytes, network order */
#define PDCP_LTE_CHANNEL_ID_TAG             0x0D
/* 2 bytes, network order */
#define PDCP_LTE_UEID_TAG                   0x0E
/* 2 bytes, network order */
/* PDCP PDU. Following this tag comes the actual PDCP PDU (there is no length, the PDU
   continues until the end of the frame) */
#define PDCP_LTE_PAYLOAD_TAG                0x01
enum rohc_mode
{
  MODE_NOT_SET = 0,
  UNIDIRECTIONAL = 1,
  OPTIMISTIC_BIDIRECTIONAL = 2,
  RELIABLE_BIDIRECTIONAL = 3
};
enum pdcp_plane
{
    SIGNALING_PLANE = 1,
    USER_PLANE = 2
};
typedef enum LogicalChannelType
{
    Channel_DCCH=1,
    Channel_BCCH=2,
    Channel_CCCH=3,
    Channel_PCCH=4
} LogicalChannelType;
typedef enum
{
    BCH_TRANSPORT=1,
    DLSCH_TRANSPORT=2
} BCCHTransportType;
#define PDCP_SN_LENGTH_5_BITS  5
#define PDCP_SN_LENGTH_7_BITS  7
#define PDCP_SN_LENGTH_12_BITS 12
#define PDCP_SN_LENGTH_15_BITS 15

3. 运行小有成果

./test 127.0.0.1 10000运行，这里127.0.0.1和10000分别是UDP报文的目的IP和PORT，可以根据需求设定。
最后总算是出来了一些PDCP解析的样子~

capture

具体代码过完年再研究吧~
记下这些东西不知不觉都已经除夕了_新年快乐

Wireshark解析PDCP-LTE

1. 基本信息get√

2 pdcp_lte_logger.c编译

3. 运行小有成果

推荐阅读更多精彩内容