Knowing the theory is one thing; reading a capture is the real skill. This module shows what each protocol looks like on the wire, with the filters and fields you need. All identities in examples are fictional.

1. Tools

⚠️ Legal note: only capture and test on your own lab or an authorised network. Transmitting on cellular spectrum without a licence is illegal; use Faraday cages / test PLMN 001-01 and licensed SDR setups.

Useful Wireshark display filters

2. Well-known ports

3. SS7 / MAP trace example — SMS delivery (annotated)

MTP3  OPC 2-100-1   DPC 3-50-2   SLS 5        ← point codes (ITU 3-8-3 format)
SCCP  UDT  CdPA: GT 38591xxxx0123  SSN 6 (HLR)     ← called party = HLR of subscriber
           CgPA: GT 4479xxxx0001   SSN 8 (MSC/SMSC) ← sender's SMSC
TCAP  Begin  otid=0x2A91
MAP   invoke  opCode = 45 (SendRoutingInfoForSM)
       msisdn   = 38591xxxxxxx
       sm-RP-PRI = true
       serviceCentreAddress = 4479xxxx0001
--------------------------------------------------------------
TCAP  End    dtid=0x2A91
MAP   returnResult  SendRoutingInfoForSM
       imsi      = 21901xxxxxxxxxx           ← note: leaks the IMSI
       networkNode-Number = 38591xxxx0200 (serving MSC)

What to read: GT → who is asking whom, opCode (45 = SRI-SM, 22 = SRI, 2 = UpdateLocation, 7 = InsertSubscriberData, 44 = MT-ForwardSM, 46 = MO-ForwardSM, 3 = CancelLocation, 4 = ProvideRoamingNumber, 71 = AnyTimeInterrogation, 70 = ProvideSubscriberInfo, 59 = ProcessUnstructuredSS-Request), OPC/DPC, TCAP transaction IDs to pair request and response. The IMSI in the reply is the privacy problem solved by home routing.

Common MAP errors (returnError codes)

4. ISUP trace — a call

IAM  CIC 12   CdPN +385911xxxx  CgPN +4479xxxx  NoA national/international  Nature of connection
ACM  CIC 12   backward indicators: subscriber free                          ← ringing
ANM  CIC 12                                                              ← answered, billing starts
REL  CIC 12   cause 16 (normal call clearing)
RLC  CIC 12

CIC = which timeslot/circuit; CdPN/CgPN = called/calling number; OLI, redirecting number, location number are parameters seen with forwarded calls.

5. Diameter trace — LTE attach authentication (S6a)

Authentication-Information-Request (AIR)   Command-Code 318, App-Id 16777251
  Session-Id        mme01.epc.mnc001.mcc219.3gppnetwork.org;123;456
  Origin-Host       mme01.epc.mnc001.mcc219.3gppnetwork.org
  Origin-Realm      epc.mnc001.mcc219.3gppnetwork.org
  Destination-Realm epc.mnc001.mcc219.3gppnetwork.org
  User-Name         2190100000xxxxx   (IMSI)
  Requested-EUTRAN-Authentication-Info  (Number-Of-Requested-Vectors 1)
  Visited-PLMN-Id   0x12F910
---------------------------------------------------------------
Authentication-Information-Answer (AIA)
  Result-Code       2001 (DIAMETER_SUCCESS)
  E-UTRAN-Vector    RAND, XRES, AUTN, KASME
---------------------------------------------------------------
Update-Location-Request (ULR)  Command-Code 316  → ULA returns Subscription-Data (APNs, AMBR)

Common S6a commands: ULR 316 / ULA, CLR 317 (Cancel-Location), AIR 318, IDR 319 (Insert-Subscriber-Data), DSR 320, PUR 321 (Purge-UE), RSR 322, NOR 323 (Notify). Other apps: Gx 16777238 (CCR/CCA command 272), Rx 16777236 (AAR 265), Cx 16777216, Gy/Ro (App-Id 4), S6c, SWx, SLg, SLh...

6. GTPv2-C trace — creating a data session

Key IEs: IMSI, MSISDN, ULI (user location: ECGI+TAI), Serving Network, RAT Type (6 = EUTRAN), APN, PAA (PDN Address Allocation = UE IP), F-TEID, Bearer QoS (QCI, ARP, MBR/GBR), AMBR, Cause. Cause 16 = accepted; 64 = context not found; 73 = no resources; 83 = APN access denied; 85 = user authentication failed.

7. SIP/VoLTE trace (excerpt)

INVITE sip:+385911234567@ims.mnc001.mcc219.3gppnetwork.org SIP/2.0
Via: SIP/2.0/UDP [2a01:xxxx::10]:5060;branch=z9hG4bK776asdhds
From: <sip:+4479xxxx@ims.example>;tag=1928301774
To: <sip:+385911234567@ims.mnc001.mcc219.3gppnetwork.org>
P-Preferred-Identity: <sip:+4479xxxx@ims.example>
P-Access-Network-Info: 3GPP-E-UTRAN-FDD; utran-cell-id-3gpp=2190100010001
Accept-Contact: *;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"
Content-Type: application/sdp
v=0 … m=audio 49170 RTP/AVP 116 117   a=rtpmap:116 AMR-WB/16000  a=rtpmap:117 AMR/8000
        a=curr:qos local none   a=des:qos mandatory local sendrecv   ← preconditions

Typical flow: INVITE → 100 Trying → 183 Session Progress (with SDP answer) → PRACK/200 → UPDATE (preconditions met, dedicated bearer up) → 180 Ringing → 200 OK → ACK; end with BYE → 200 OK.

8. LTE / 5G NAS and radio causes

EMM cause values (4G Attach/TAU Reject)

ESM cause values (PDN connectivity reject)

5GMM causes (Registration Reject) — similar idea

3 illegal UE · #5 PEI not accepted · #6 illegal ME · #7 5GS services not allowed · #11 PLMN not allowed · #12 TA not allowed · #13 roaming not allowed in TA · #22 congestion · #27 N1 mode not allowed · #62 no network slices available · #69 insufficient resources for specific slice and DNN.

Radio-level events

RRC Connection Request/Setup/Complete → Security Mode Command → RRC Reconfiguration (bearers) → Measurement Report → Handover Command; failures: RLF (Radio Link Failure), RRC re-establishment, T310/T311 timers, Random access failure.

9. 5G SBA trace — registration & authentication (HTTP/2)

POST /nausf-auth/v1/ue-authentications          (AMF → AUSF)
{ "supiOrSuci": "suci-0-219-01-0-0-0-xxxxxxxx", "servingNetworkName": "5G:mnc001.mcc219.3gppnetwork.org" }
→ 201 Created  { "authType":"5G_AKA", "5gAuthData":{ "rand":"…", "hxresStar":"…", "autn":"…" }, "_links":… }

POST /nudm-ueau/v1/{supi}/security-information/generate-auth-data   (AUSF → UDM)
POST /namf-comm/v1/ue-contexts/{ueContextId}/n1-n2-messages          (SMF → AMF)
POST /nsmf-pdusession/v1/sm-contexts                                  (AMF → SMF)
PFCP Session Establishment Request (SMF → UPF, N4)  →  Response  (Cause: Request accepted)

Look at: HTTP status (200/201/204 ok, 307/308 redirects with NRF discovery, 400 bad, 403 not allowed by OAuth scope, 404 not found, 429 too many requests, 500/503 failures), Authorization: Bearer token (OAuth2 from NRF), 3gpp-Sbi-* headers, and the NRF discovery (GET /nnrf-disc/v1/nf-instances?target-nf-type=SMF).

10. SMPP trace — A2P submit

bind_transceiver   system_id=bank01 password=********         → bind_transceiver_resp  command_status=ESME_ROK
submit_sm  source_addr=MyBank (TON 5 alphanumeric)  dest_addr=3859xxxxxxx  data_coding=0  short_message="Your code is 482913"
                                                                → submit_sm_resp  message_id=4F2A91  status=ESME_ROK
deliver_sm (esm_class=0x04)   short_message="id:4F2A91 … stat:DELIVRD err:000"          ← the receipt
enquire_link ↔ enquire_link_resp                                 ← keep-alive
unbind

11. Reading a trace — a checklist

1. Who talks to whom? Identify the two nodes (IP/port, GT, point code, realm).
2. Which protocol and procedure? Use the port and message name.
3. Find the first failure. Errors cascade; the earliest negative response (cause/Result-Code/HTTP code/ABORT) is the root.
4. Check timers. Retransmissions and gaps point to packet loss or an overloaded peer.
5. Check identities. Wrong MCC/MNC, missing IMSI, unknown APN, bad realm.
6. Check direction. Which side sent the reject? Visited or home?
7. Compare with a working trace from the same procedure.
8. Correlate across interfaces using IMSI, TEID, Session-Id, Call-ID or SUPI.

Remember this: every procedure is a short conversation of request/response messages. Learn the 10–15 messages and cause codes of each protocol and most traces read like a story.