Technical Helpweb

- more articles

How to view ISDN & SS7 traces using Wireshark

Introduction:

This article describes the steps required to enable ISDN or SS7 diagnostics on the Dialogic® Integrated Media Gateways, including the Dialogic® IMG 2020 Integrated Media Gateway (IMG 2020), formerly referred to as Dialogic® BorderNet™ 2020 Session Border Controller. It also describes how to use the trace2pcap utility to convert the ISDN Q.931, SS7 MTP2 or ISUP trace to a pcap file that can be viewed in Wireshark.

All instructions hereon which refer to the IMG 1010 apply equally to the IMG 1004.

On the IMG Gateway, ISDN and SS7 (MTP2/3) tracing can be enabled to provide detailed information for ISDN D channels, SS7 Links and call processing. This information is logged as a hex string that the user then needs to decode.

A sample trace is also provided. 

Enabling tracing

1. ISDN diagnostics: The ISDN diagnostics are accessed through the IMG CLI via a telnet session (IMG 1010) or ssh session (IMG 2020).
   • From the Advanced Debug menu type I to access the ISDN menu.
   • To enable the Q.931 diagnostics for all ISDN spans type 207ff .
   • When done type 200 to disable the Q.931 diagnostics.
2. SS7 diagnostics:
   • To troubleshoot SS7 link failures, enable MTP2 & MTP3 diagnostics.
     • From the Advanced Debug menu type 3s to enter the SS7 menu.
     • To enable MTP2 diagnostics type bxxx (where xxx is the SS7 link id). To disable type Bxxx.
     • To enable MTP3 diagnostics type fsx (where x is the SS7 stack id). To disable type Fsx.
     • For more information on MTP2/3 troubleshooting please refer to article SS7 MTP2/MTP3 Troubleshooting
   • For call / CIC related messages, the ISUP messages are included in the standard IMG call trace. MTP2 & MTP3 tracing should be disabled. The ISUP trace can be enabled using the Call Trace object in ClientView (IMG 1010) or the WebUI (IMG 2020).

How to run trace2pcap

The trace2pcap utility can be run on Windows or Linux and converts the trace to a format that can be viewed in Wireshark.

Converting a trace after it has been captured to a log file.  

NOTE: Do not edit the trace text file as this may prevent the tool from decoding it correctly.

1. Open a DOS window or a Linux terminal window.
2. Enter the following on the command prompt.
   • trace2pcap <in_File> <out_File>.
   • example: trace2pcap ss7trace.log ss7trace.pcap
3. Use -h for detailed help.

The .pcap output file can then be opened in Wireshark.

Decoding diagnostic data in real time

1. Start the IMG Gateway call trace.
2. On the NFS server that stores the call trace file (usually the GCEMS for an IMG 1010 or the EMS or other Linux-based NFS server for IMG 2020) open a terminal window and run either of the following commands. This will tail the sysLog file which is then piped through the trace2pcap utility and into Wireshark.
   • tail -f /location_of_call_trace_file/sysLog_xx.log | /location_of_trace2pcap/trace2pcap - - | wireshark -k -i -
   • tail -f /location_of_call_trace_file/sysLog_xx.log | /location_of_trace2pcap/trace2pcap - - | tshark -V -n -i -
   • replace 
   • location_of_call_trace_file with the actual location of the call trace file. With an IMG 1010, this would usually be /opt/dialogic/common/calltracing on the GCEMS server. With an IMG 2020, this is the location specified in the Call Tracing object.
   • sysLog_xx.log with the actual name of the call trace file.
   • location_of_trace2pcap with the location where you copied the trace2pcap executable.
     
     

Wireshark notes:

For SS7 traces, go to the Edit menu and select Preferences, and under Protocols, select MTP3 to set the required MTP3 standard and Point Code format.

Example:

trace2pcap cg_isdn.txt - | tshark -V -i -
TRACE2PCAP Version 3.7 - Copyright 2009 Dialogic Corporation
Processing trace as type: AG/CG ISDN
…
Copied 8 Q.921 packets
Capturing on -
Frame 1 (37 bytes on wire, 37 bytes captured)
Arrival Time: Jan 7, 1970 14:19:22.230000000
…
Q.931
     Protocol discriminator: Q.931
     Call reference value length: 2
     Call reference flag: Message sent from originating side
     Call reference value: 0380
     Message type: SETUP (0x05)
     Bearer capability
          Information element: Bearer capability
          Length: 2
          1... .... = Extension indicator: last octet
          .00. .... = Coding standard: ITU-T standardized coding (0x00)
          ...0 1000 = Information transfer capability: Unrestricted digital information (0x08)
          1... .... = Extension indicator: last octet

Product List
Dialogic® IMG 1010 Integrated Media Gateway
Dialogic® IMG 1004 Integrated Media Gateway
Dialogic® IMG 2020 Integrated Media Gateway (IMG 2020), formerly referred to as Dialogic® BorderNet™ 2020 Session Border Controller

Related Documentation 

How to enable call tracing on the IMG Gateways:
IMG 1010: http://www.dialogic.com/webhelp/IMG1010/10.5.3/WebHelp/img.htm#calltracing.htm
IMG 2020: http://www.dialogic.com/webhelp/BorderNet2020/2.2.0/WebHelp/default.htm#calltracing.htm