Skip to content

Troubleshooting

Jump to bottom
Louis Royer edited this page May 16, 2024 · 4 revisions

Cannot decode NR-RRC messages in Wireshark

If you cannot decode NR-RRC messages in Wireshark, here is a list to assist your troubleshooting:

  1. Check your Wireshark version is 3.0.0 or higher. NR-RRC is not implemented in older versions of Wireshark.
  2. This project comes with a pcap directory that contains some network captures. Try open the latest pcap of this directory and clear any display filter you may have set (don't forget to press enter to apply). If the plugin is correctly installed, you should be able to see the following (using the file rls_3-2-0.pcapng): Screenshot of rls_3-2-0 with the plugin successfully installed If you see the image below instead, your plugin is not correctly installed: Screenshot of rls_3-2-0 without plugin
  3. If you are able to read the example capture but not your own, check on what network interface you have started the capture. If you can only see NGAP or SCTP, you are capturing on the AMF-gNB link. If you can only see GTP, you are capturing on the gNB-UPF link. You want to capture packets on the UE-gNB link.
  4. If you are not able to see NR-RRC the example capture, you have an installation issue. In Wireshark, go to Help > About Wireshark > Plugins. You should see a line starting with rls.lua: Plugin list

If you do not see this line but believe your installation is correct, check you have reloaded your plugins (Analyze > Reload Lua Plugins, or Ctrl+Shift+L) or restarted Wireshark after the installation. If you have already reloaded your plugins, go to Help > About Wireshark > Folder. You should see the following: Wireshark Folders configuration

Relevant lines are Personal Lua Plugins and Global Lua Plugins (those ending with lua scripts in the Typical Files column). The path provided may differ depending on your distribution. Ensure the plugin directory is present (and not empty) at one of those locations. If this installation path was the issue, don't forget to reload your plugins!

  1. If you have tried all the above, but this still doesn't work, please open a new issue. Don't forget to include:
  • Your exact OS version
  • Your exact Wireshark/Tshark version
  • A copy of your pcap file
  • The exact UERANSIM version you are using
  • The exact version of the this plugin you are using (precise the commit number)
  • Screenshots of what is displayed on your Wireshark and/or text copy of your Tshark output
  • Any relevant precision to help debugging
Clone this wiki locally