V 1.

000
GPRS/UMTS & LTE Troubleshooting with Wireshark GPRS/UMTS & LTE Troubleshooting with Wireshark
Course Duration:
2 days
Course Description:
This practical course enables the participants to find throughput issues and shows how to solve them
by using Wireshark on the client and/or on the network side.
Prerequisites:
articipants should be already familiar with !"#$ %&T# and '#(. This should stem from
previous e)posure to design$ troubleshooting or operations *obs in !"#/%&T#/'#(
telecommunication networks.
Course Target:
(fter the course the participant is able to use Wireshark efficiently for drop and throughput analysis.
We teach the students how to set filters$ add more columns for better fault analysis and how to
e)port logs for further post+processing e.g. in ,)cel.
Some of your Questions that will be answered:
'ow can a technician find out if the %,$ -ode.$ "-/$ /ore or the 0nternet are responsible for low
throughput1 &any times this re2uires T/+tracing on the client$ !b/0u+ps and on !n/!i+interface.
What performance indicators can be seen in a T/ throughput graph1
Why can3t the ,nd+to+,nd "TT not go below a minimum value but increases when the T/+Window
#i4e increases1 ( too high Window #i4e fi)es delay issues caused by the network but slows down
the T/+retransmissions and demands higher buffers in core and radio access network.
Why T/ #elective (/53s are counterproductive for T/+6ata frames but would be good for T/+
(/5 7 out of se2uence delivery of T/+(/53s would be beneficial for the throughput if supported1
Why /ore -etwork can throttle the throughput down due to out+of+se2uence delivery1
Who should attend this Course:
The course is mainly targeted for 8perators and %,+vendors which need to identify network
problems leading to bad throughput and drops.
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
Table of Content:
How to use Wireshar in !obile "etwors
Wireshar !enu #ar
references for !b$ 0u+ps$ 0u+cs$ 0ub$ #1$ !n/!p/!i ivnterfaces
Verification of #ettings of important Telecom rotocol3s
;rame "elay$ .##!$ !"#+<</= "(-($ -.($ ##/8$ ""/+%&T#$ ""/+<T,$ #1+($ #1+&&,$ T/
>e.g. relative T/+packet numbering?
Start Tracing $P%connection &"etwor $nterface Card's(
/apture 0nterface>s? for &onitoring
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
Wireshark reference #ettings
Timestamp options$ /olori4ing two different 0 >e.g. ;T? /onnections in same <ogfile
(dding customi4ed /olumn3s for enhanced analysis
Te)t+e)port or /#V+e)port allows further post+processing in ,)cel
,)port of <ogfiles as Te)tfile$ /#V+file$ /(+file
)e*iewing important TCP+$P ,undamentals
8verview of 0$ T/ and %6 header
T/ #low #tart and /ongestion (voidance
T/ /onnection ,stablishment @ "elease
A+way handshake$ "eceive Window #i4e of /lient is critical$ "eset a /onnection
8verview of important T/+arameters
Window #i4e$ "ound Trip Time$ &a)imum #egment #i4e$ &a)imum Transfer %nit$ #ocket arameter
.andwidth 6elay roductB Throughput C Window #i4e / "TT
#pecifics of a Wireless #ystem like !"#$ %&T# or <T,B
+ Throughput should be preferably limited by the %,3s /apability3s
+ The ,+t+,+"TT cannot fall below a minimum value but increases easily
+ Window #i4e of T/+client >e.g. laptop? should be set to a certain value matching the "TT of the system
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
/oncurrent 6ownload and %pload leads to lower throughput
%pload throttles down the download due to Windows+ issue >no prioriti4ation of T/+(/53s?$
<inu) computer are able to prioriti4e the sending of T/+(/53s before T/+data are sent
0mpact of 6uplicate (/53s @ ;ast "etransmissions on #ubscriber Throughput
ro3s and /on3s of #elective (cknowledgments
0ssue of lower layer retransmissions while #elective (/53s invoke T/+"etransmissions resulting in
DdoubleE resp. unnecessary retransmissions$ (dvantage when %T"(- or /% do not stall the forwarding of
T/+(/53s to the T/+#erver and thus allow out+of+se2uence delivery of T/+(/53s if they hang in
retransmissions due to "</+(&
( T/ aware %T"(- or /% would be beneficial for the throughput if T/+(/53s are handled preferred
Quic -ogfile .nalysis using /01pert $nfo2
(nalysis of ,)ample <og3s
;or every new T//0 acket the /lient sends a 6uplicate (/5 pointing out that a certain older T//0+
packet is still missing. (ll the newer incoming T//0+packets have to be buffered until the very
missing/dropped T//0 acket is re+transmitted by the #erver and properly received by the /lient.
0ssues with .uffer #i4e in /lient and -etwork -odes are discussed
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
$3%4raph in Wireshar &for quic throughput analysis(
Detailed Throughput and )TT .nalysis
6etermining #low #tart and "etransmission using various T/ #tream !raph3s
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
Troubleshooting of )." and Core 0rrors
,ailure 5 Drops in 4P)S+04P)S
;iltering in Wireshark
!"# /onnection 'ang+up with 6rop
<ow Throughput in ,!"#
,!"# Throughput per cell/.V/0$ faulty !"# 6ial+up software >dashboard issue with </ protocol?
!"# #uspend after A!F2! '8 but no #uspend (/5
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
(ttach (ccept but no (ttach /omplete from %,
/iphering 5ey mismatch between %, and #!#-
,ailure and Drops in 6!TS
Core "etwor causes Duplicate .C7's and ,ast )etransmissions
8ut of #e2uence 6elivery of T/+ackets on !n/!p+ or !i+interface
%, sends 6uplicates (/53s in uplink= %T"(- assures 0n+#e2uence 6elivery through "</+(& and '("G=
!!#- discards sometimes 0+packets
6elta+measurement between !i >incoming? and !n >outgoing? of 0+ackets= 0nternet #erver may stick with
/ongestion (voidance only after T/+"etransmission due to packet loss
"</+(& 0n+#e2uence and 8ut+of+#e2uence 6elivery /onfiguration
;or "el. 99 bearers$ "</+(& out+of+se2uence delivery is counter+productive as it causes 6uplicate (/53s.
.earers mapped on "el. H/I '#+6#/' or "el. I ,+6/' provide almost in+se2uence deliver due to '("G
underneath unless during '#( #erving /ell /hanges and if "</+(& is configured for out+of+se2uence
deliveryJ
#"-/ can delay T//0 packets mapped on '#+6#/' unnecessary
0ub '#+6#/' ;rame rotocol >user plane? trace re2uired to compare with 0u+ps user plane timing
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
&odem/6ata+card hangs+up >%, software bug?
8ne or more T/ "etransmissions for same T/+acket but no (/5 from T/+client$ then %, performs
sudden !"# (TT(/' due to #witch+off+on$ 6 /onte)t (ctivation and DnormalE download resumes
,ailure and Drops in -T0
S8%!!0 Signaling $ssues
%, lost in ,+%T"(- >uplink drop?
%, drops due to downlink out+of+sync
""/ "e+establishment rocedure #cenario
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
Tracking (rea %pdate after failed ""/ "e+establishment
-etwork aging in case of downlink 6ata 6elivery$ (s long as the T/ Timers in %,//lient are not fired$
T/ triggers the /onnection ,stablishment with ,+%T"(- again >same in !"# and %&T#?$ %, keeps its
0+address after drop or being in 0dle &ode until 6etach or D6eactivate 6 /onte)tE
9:.P Signaling $ssues
'andover #ignaling
&eaning of sn#tatusTransfer$ Why are there duplicate K2( messages visible1
'ow to trace the complete signaling of a single %, on #1+&&,1
#/T does not distinguish the #ignaling for different %sers/%,3s between e-ode. and &&,. Thus #1( in
e-ode. assigns upon connection establishment >e.g. with (TT(/' ",G%,#T? a uni2ue number called
e-.+%,+#1(+06. 0n response the &&, allocates his uni2ue number &&,+%,+#1(+06 and mirrors back
the number which e-ode. has assigned for the call. Thus from that moment on the %,/%ser is uni2uely
identified by two numbers and e-ode. refers to the &&,+06 when sending some #1(+message to the
&&, where as the &&, refers to e-.+06 when sending some message for the specific %, to e-ode..
'ow to identify the %ser lane /onnection >#1+%? of e-. 7 #!W for a certain
%,1
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
-ow Throughput Troubleshooting in HSP. "etwors
$ub ,low Control $ssues
.ad '#+6#/' ;low /ontrol
,+6/' ; throttles uplink Throughput
,)ample for a bunch of corrupted ,+6/' frames. The last correct received packet on 0ub is having
se2uence number 291210. (fter that it takes 2.Hs until the ne)t non+corrupted packet is received on 0ubB
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
Iub Flow Control
0
10000
20000
30000
40000
50000
60000
70000
80000
90000
100000
1
2
:
0
4
:
3
9
.
7
0
7
1
2
:
0
4
:
4
3
.
4
9
6
1
2
:
0
4
:
4
3
.
7
7
8
1
2
:
0
4
:
4
4
.
0
8
2
1
2
:
0
4
:
4
4
.
3
6
9
1
2
:
0
4
:
4
4
.
7
2
5
1
2
:
0
4
:
4
5
.
1
8
9
1
2
:
0
4
:
4
5
.
7
2
0
1
2
:
0
4
:
4
6
.
0
2
2
1
2
:
0
4
:
4
6
.
2
8
2
1
2
:
0
4
:
4
6
.
5
4
2
1
2
:
0
4
:
4
6
.
8
2
6
1
2
:
0
4
:
4
7
.
0
2
7
1
2
:
0
4
:
4
7
.
2
2
0
1
2
:
0
4
:
4
7
.
4
0
6
1
2
:
0
4
:
4
7
.
7
2
7
1
2
:
0
4
:
4
8
.
1
0
0
1
2
:
0
4
:
4
8
.
5
9
8
1
2
:
0
4
:
4
8
.
8
5
8
1
2
:
0
4
:
4
9
.
1
2
0
1
2
:
0
4
:
4
9
.
4
6
6
1
2
:
0
4
:
4
9
.
6
3
9
1
2
:
0
4
:
4
9
.
8
5
0
1
2
:
0
4
:
5
0
.
0
1
6
1
2
:
0
4
:
5
0
.
2
1
8
1
2
:
0
4
:
5
0
.
7
8
0
1
2
:
0
4
:
5
0
.
9
8
4
1
2
:
0
4
:
5
1
.
1
5
1
1
2
:
0
4
:
5
1
.
8
0
6
1
2
:
0
4
:
5
2
.
0
6
6
1
2
:
0
4
:
5
2
.
3
2
6
1
2
:
0
4
:
5
2
.
7
6
4
1
2
:
0
4
:
5
3
.
0
2
1
1
2
:
0
4
:
5
3
.
5
7
6
1
2
:
0
4
:
5
3
.
8
3
6
1
2
:
0
4
:
5
4
.
3
2
2
1
2
:
0
4
:
5
4
.
6
3
4
1
2
:
0
4
:
5
4
.
8
9
0
Time
B
y
t
e
s
/
8
0
m
s
FP: User Buffer Size Credits[Bytes/80s! "r#$sittedBytes%Bi$
Combined Trace .nalysis of .ir%interface &6u( and Wireshar
'#+#//' #cheduling (nalysis
#erving !rant &onitoring for low '#%( Throughput
#0"+Target in %T"(- and %, TK ower limitation
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.
T//0 (/5 counting on /lient <aptop
>typically a Windows / ack3s only every 2
nd
T/+frame? : downlink packets arrive too slow although
/lient+/ ack3s nicely every 2
nd
T/+frame 7 self+clocking principle of the T/+connection. ( T/+#erver
in #low #tart mode would double the number of T/+frames for every received T/+(/5
'igh uplink .<," >"TT? throttles '#+6#/' Throughput
(s the downlink '("G of '#+6#/' >and also uplink '("G of ,+6/'? is usually very robust$ throughput
issues only occur due to too high T/+"TT >high ,+to+, delays? or T/+acket out+of+se2uence delivery
caused by /ore or due to lossy /ore -etwork >!!#-$ #!#-$ "outer? or lossy 0ub/0u+ps >e.g. too
aggressive (T& overbooking?$ provided that the /G0 reporting of %, is good and that sufficient ,1+links on
0ub are available and that more than 1 '#+#//' is configured in the cell and *ust one %, is using '#6(
0-(/8- !mb' 1999 : 2010. (ll rights reserved. "eproduction and/or unauthori4ed use of this material is prohibited and will be
prosecuted to the full e)tent of !erman and international laws.