Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Dissection of LTE-RRC

From: Reinhard Speyerer <rspmn@xxxxxxxx>
Date: Tue, 31 Aug 2010 23:17:16 +0200
On 08/31/10 09:38, Vishal Kumar Singh wrote:
> [...]
> Please, suggest me a suitable method to this. Can i select based on
> message type to differentiate UL CCCH, UL DCCH, DL CCCH messages? Or, is
> there any other method to differentiate the messages?
>

Hi Vishal,

using Lua this is possible by prefixing each message with e.g. a single byte message
type and calling the appropriate dissector based on the message type like this:

do
  rlsmon_proto = Proto("rlsmon","rlsmon","rlsmon Protocol")
  function rlsmon_proto.init()
    local function rrcdissector(name)
      local disname = string.gsub(string.lower(name), "[ -]", ".")
      return { protocol = name, dissector = Dissector.get(disname) }
    end
    rlsmon = {
      [0]  = rrcdissector("RRC DL-DCCH"),
      [1]  = rrcdissector("RRC UL-DCCH"),
      [2]  = rrcdissector("RRC DL-CCCH"),
      [3]  = rrcdissector("RRC UL-CCCH"),
    }
  end
  function rlsmon_proto.dissector(buffer,pinfo,tree)
    local msgtype = buffer(0,1):uint()
    local payload = buffer(1):tvb()
    pinfo.cols.protocol = rlsmon[msgtype].protocol
    rlsmon[msgtype].dissector:call(payload,pinfo,tree)
  end
  local wtap_encap_table = DissectorTable.get("wtap_encap")
  wtap_encap_table:add(wtap.USER1, rlsmon_proto)
end

A similar scheme should also be applicaple for your LTE RRC case.

Regards,
Reinhard