The Challenge of GTP-Only 5G Captures
Network captures from 5G base stations, specifically on the F1-U interface, can present a confounding problem. A recent bug report highlighted a scenario where such captures, when analyzed, appeared to contain nothing but GTP (GPRS Tunnelling Protocol) data. This left analysts with a seemingly empty trace – no SIP signaling, no RTP voice packets, just GTP tunnels. Wireshark, by default, would stop its analysis there, presenting a dead end for anyone trying to understand the actual communication flow within those tunnels.
This situation arises because the F1-U interface encapsulates PDCP (Packet Data Convergence Protocol) PDUs within GTP-U tunnels. In certain lab configurations, particularly with older or simplified builds, the PDCP layer might employ a null cipher (NEA0) and omit the SDAP (Service Data Adaptation Protocol) header. This configuration means that the inner IP packet begins at a fixed offset within each T-PDU (Transport Protocol Data Unit). Without understanding this specific structure, the actual payload remains hidden, masked as mere tunnel overhead.
Unpacking the GTP Tunnels: A Byte-Level Revelation
The key to unlocking these hidden calls lies in understanding the PDCP header and the encryption boundary. Byte 0 of a T-PDU typically indicates its type. In the described capture, this byte was 0x80, signifying a PDCP-NR data PDU. This PDU includes an 18-bit sequence number, which, combined with other control bits, forms a 3-byte header. Immediately following this 3-byte header, at byte 3, the data begins. The byte here was 0x45, a definitive indicator of an IPv4 packet. Crucially, the absence of an SDAP header means there's no additional layer of encapsulation between the PDCP header and the IP packet itself.
This 0x45 byte is the critical tell. It signifies that the IP packet, and by extension its contents (SIP signaling and RTP voice), are transmitted in the clear, at least from the perspective of the PDCP layer. The encryption, if any, is handled at a higher layer (like IPsec) or is absent in this specific configuration. The challenge then shifts from decrypting data to simply re-framing the captured data correctly. By stripping away the initial 3 bytes of the PDCP header and treating the subsequent data as raw IP packets (using a LINKTYPE_RAW framing), the capture transforms dramatically.
From GTP Tunnels to Two-Party VoNR
Once these initial bytes are removed and the data is re-framed, the analysis reveals a wealth of previously hidden information. The bug report indicates that 2,960 inner IPv4 packets emerge from the single GTP tunnel. These packets constitute a two-party Voice over NR (VoNR) call. This means that all the necessary signaling (SIP) and media (RTP) for a voice conversation were present within the GTP tunnel all along, merely obscured by the protocol layering and the specific configuration of the PDCP layer.
The implications of this finding are significant for network analysis and security. It demonstrates that seemingly empty GTP captures can contain rich communication data. Network engineers and security professionals must be aware of these protocol layering nuances. The ability to extract VoNR calls from such captures allows for more thorough network monitoring, performance analysis, and potentially, security investigations. Understanding the PDCP header structure and the absence of higher-layer headers is paramount. The encryption boundary, in this specific case, being only a few bytes into the T-PDU, is a crucial detail that makes manual inspection and programmatic extraction feasible.
Broader Implications for 5G Network Analysis
This revelation challenges the assumption that a GTP-only capture from a 5G F1-U interface is devoid of application-layer data. It underscores the importance of deep packet inspection capabilities that can look beyond the immediate protocol layers. For developers working with 5G network simulation tools like srsRAN, it highlights the need for robust handling of PDCP and GTP encapsulation, even in simplified lab environments. The bug report itself is a testament to the community's effort in uncovering and documenting these intricate details of 5G protocols.
The ability to reconstruct these calls means that previously unanalyzable traffic can now be scrutinized. This is critical for debugging network issues, verifying Quality of Service (QoS) for voice services, and understanding the complete communication path. It also raises questions about data retention and privacy in networks where such captures might be logged without a clear understanding of the data they contain. The technical insight here is that the 'null cipher' and lack of SDAP header create a predictable structure, turning a complex obfuscation into a solvable puzzle.