Wireshark filters for GSM

System Information

    gsmtap.chan_type==1

• CCCH / SI1 / Cell Channel Description
  • List of ARFCNs
• CCCH / SI2 / Neighbour Cell Description
  • List of ARFCNs
• CCCH / SI3 / Cell Identity
• CCCH / SI3 / Location Area Identification
  • MCC
  • MNC
  • LAC
• CCCH / SI4 / Location Area Identification
  • MCC
  • MNC
  • LAC
• CCCH / SI4 / Channel Description - CBCH
  • Hopping Channel: yes/no
  • ?Single channel ARFCN

Immediate Assignment

    gsm_a.dtap.msg_rr_type==0x3f

look for circuit switched IAs

• CCCH / RR / IA / Channel Description
• CCCH / RR / IA / Mobile Allocation (map for hopping ARFCNs)

and eventually build a custom filter for it,

    Channel Description > Apply as filter > Selected

    ts=X

SDCCH/8

force sub-slot as filter

gsmtap.sub_slot==Y

filter-out fragments, func=UI, func=RR

gsmtap.chan_type==8

look for Cipher Mode Command

gsm_a.dtap.msg_rr_type == 0x35