TSP Lab	Sga_GTPMon - The GTP Monitor	Sga_GTPMon

The GTP Monitor module

Features

It monitors Gn interface between USGSN and GPRS SGSN
Captures IP traffic from the selected network adapter
Protocol and port filter can be defined
Separates GTP-U and GTP-C and GTP' protocols and decodes GTP-C content in detail
Can handle captured data from files (libPcap format)
Forwards decoded encryption information to a remote machine (KeyServer)

Menu	Menuitem	Shortcut(s)	Meaning
[Log]
	Find line containing...	(Ctrl-F)	Finds text in log window
	Find next matching line	(F3)	Finds next occurrence of text in log window
	Details		Detail level of logging (Off, Normal, Detailed, or Debug)
	Flush status-line counters		Writes status counters into the log These counters have been flushed once a day automatically.
	Flush & reset status-line counters		Clears status counters after writing them into the log
[KeyServer]
	Allow autoconnect	(Ctrl-A, or )	Permits of connection to KeyServer.
	Disconnect now!		Breaks off KeyServer connection
[Capture]
	Reload input device list	(Ctrl-I)	List of devices to be captured can be reloaded from `GTP_mon.ini/[Capture]/` section without terminating the program if the list has been modified.
[Options]
	Auto scroll	(ScrollLock, or )	Allows automatic scrolling of the log screen
	Save settings		Saves actual settings into the configuration file

Gn #0..#9: the colors of "lamps" refer to the state of input devices:
- white: the input device is not defined in SgaGTP_Mon.ini/[Capture]
- green: the input device is defined and ready to be captured
- red: the input device is defined but not ready because it does not exits or has gone wrong or has been badly defined. Check if the device listed in SgaGTP_Mon.ini/[Capture] is really exits or properly defined.
Rx'd N bytes in M datagrams: The module has seen N bytes in M datagrams
Uptime: time elapsed since module has been started up
KS: the state of connection to KeyServer
Fwd'd X IMSI-Kc pairs: X IMSI-Kc pairs have been forwarded to KeyServer

Section	Entry	Example	Meaning
[Position]
	iLeft	140	Position of the program module on the display screen
	iTop	72	Position of the program module on the display screen
	iWidth	995	Position of the program module on the display screen
	iHeight	694	Position of the program module on the display screen
[Options]
	bAutoScroll	True	(Refer to the `[Options]/Auto scroll` menu item!)
[Advanced]
	wLogDetailLevel	3	(Equals to the listed order; refer to the `[Log]/Details` menu item!)
	dwMaxLinesInLogWindow	1000	Number of lines in the log window on screen
	sLogFilesPath	d:\GPRS\Logfiles	Path for the LOG files
[KeyServer]
	bAllowAutoConnect	False	(Refer to the `[KeyServer]/Allow autoconnect` menu item!)
	sIPAddress	127.0.0.2	IP address of KeyServer
	wTCPPort	7002	Port where KeyServer is listening to GTP Monitor
[Capture]
	sInputDevice#N	rpcap://\Device\NPF_{E1638A3A-E7C2-4B62-9478-35F9D609855A}	Device on what GTP Monitor will capture. At most 10 devices can be defined and N can be 0..9.
	sInputFilter	udp port 2123	Defines protocol and port filter for capturing

v1.02

(n) Capturing from multiple input devices (i.e., Ethernet interfaces).
(c) INI/[Capture]/sInputDevice is obsolete.
(n) INI/[Capture]/sInputDevice#0, #1, ... #9.
(c) On-screen input device selection is no longer available.
(c) Capture menu / "Select input", "Start capturing", and "Stop capturing" no longer exist.
(n) Capture menu / "Reload input device list" is new; Ctrl-I can also be used to invoke.

v1.01

(n) Triplets and faked-triplets (from quintuplets) derived from Identification Response (49) messages are also decoded and forwarded to KeyServer.
(n) Handles and decodes Identification Request (48) messages.
(n) Handles and decodes Identification Response (49) messages.
(c) Cause (1) parameters are decoded in details.
(n) Authentication Triplet (9) parameters are decoded in details.
(n) Authentication Quintuplet (136) parameters are decoded in details.
(n) Shift-ESC combination minimizes application window.
(n) Clear key (NumPad-5) clears highlight (selection) in either window.

v1.00

(n) Source of ActualKc (derived (faked) from a CK-IK pair or not) is indicated.
(n) Source of triplets (either real or faked from quintets) is indicated.

v0.99

v0.96

(n) Only relevant (SGSN Context Response) messages with their appropriate parameters are logged in Detailed log level mode.
(c) WinPCAP time-out parameter is further decreased from 500 to 100 milliseconds for more experiments.

v0.95

(n) Triplet and Quintuplet (including 'faked' Kc and SRES) array elements are decoded and logged (in Detail and Debug log level modes).
(c) WinPCAP time-out parameter is decreased from 1000 to 500 milliseconds for experiments.

v0.91