Skip to content

Packet Analysis Tips

This compiles practical "good to know for speed" tips for when you analyze 5GC signaling with Wireshark. For the detailed flow of each procedure, refer to the relevant chapter in the main content; for protocol definitions, refer to the dictionary.

Quick Reference of Display Filters by Protocol

First, here are representative filters for grasping the overall picture.

Purpose Display Filter
NGAP (N2, gNB⇔AMF) ngap
NAS-5GS (N1, UE⇔AMF/SMF, encapsulated within NGAP) nas-5gs
PFCP (N4, SMF⇔UPF) pfcp
GTP-U (N3/N9, user plane) gtp
SBI (HTTP/2, between NFs) http2

NAS Is Contained Within NGAP

N1 NAS messages do not flow on their own; they are carried encapsulated within the N2 NGAP messages. In Wireshark, expanding a packet caught with ngap reveals nas-5gs inside. The nas-5gs filter also picks up these encapsulated instances.

Use the Transport as a Clue

If you are unsure which interface a packet belongs to, the transport layer is a clue.

Interface Transport Typical Port
N2 (NGAP) SCTP 38412
N4 (PFCP) UDP 8805
N3/N9 (GTP-U) UDP 2152
SBI (HTTP/2) TCP + TLS implementation-dependent (resolved by NRF)

Port Numbers Are Just a Guide

There are values defined by the standard (PFCP=8805, GTP-U=2152, NGAP SCTP=38412, etc.) and those that change by implementation or configuration (such as the SBI listening port). Note that SBI should not be assumed to have a fixed port; it is resolved via service discovery (NRF).

Fields That Speed Up Isolation When Focused On

  • NGAP: Procedure Code (which procedure), RAN UE NGAP ID / AMF UE NGAP ID (association of the UE)
  • NAS-5GS: Message Type (Registration Request / Service Request, etc.), 5GMM cause / 5GSM cause (reason for failure)
  • PFCP: Message Type (Session Establishment/Modification/Deletion), SEID, and each of the PDR/FAR/QER/URR rules
  • HTTP/2 (SBI): :path (which service API), :status (response code), :method

Common Oversights

  • Encrypted segments: Messages after AS/NAS security has been activated are encrypted and their contents are not visible. How they appear changes before and after SMC.
  • Fragmentation/reassembly: Messages split over SCTP or TCP appear differently depending on Wireshark's reassembly settings.
  • One transaction = multiple interfaces: A single procedure (e.g., PDU Session establishment) spans N1/N2/N4. To avoid misunderstanding something as "missing" by looking at only one side, it is safest to gather captures of all the interfaces involved.