From 7d3b3d0e717be3a737a30e68457d7c6835810971 Mon Sep 17 00:00:00 2001
From: Holger Hans Peter Freyther <zecke@selfish.org>
Date: Mon, 7 Jun 2010 19:08:57 +0800
Subject: [PATCH] GPRS: Add script to track the N(U) on GPRS LLC messages..

tshark -q -X lua_script:gprs/gprs-verify-nu.lua -r trace.pcap

Output:
JUMP in N(U) on TLLI 3741437425 and SAPI: 9
	 last: 1 now: 3
JUMP in N(U) on TLLI 3741437425 and SAPI: 9
	 last: 10 now: 12
---
 openbsc/contrib/gprs/gprs-verify-nu.lua | 55 +++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 openbsc/contrib/gprs/gprs-verify-nu.lua

diff --git a/openbsc/contrib/gprs/gprs-verify-nu.lua b/openbsc/contrib/gprs/gprs-verify-nu.lua
new file mode 100644
index 000000000..63cc49268
--- /dev/null
+++ b/openbsc/contrib/gprs/gprs-verify-nu.lua
@@ -0,0 +1,55 @@
+-- This script verifies that the N(U) is increasing...
+--
+do
+	local nu_state_src = {}
+
+	local function init_listener()
+		-- handle the port as NS over IP
+		local udp_port_table = DissectorTable.get("udp.port")
+		local gprs_ns_dis = Dissector.get("gprs_ns")
+		udp_port_table:add(23000,gprs_ns_dis)
+
+		-- we want to look here...
+		local llc_sapi_get = Field.new("llcgprs.sapib")
+		local llc_nu_get = Field.new("llcgprs.nu")
+		local bssgp_tlli_get = Field.new("bssgp.tlli")
+
+		local tap = Listener.new("ip", "udp.port == 23000")
+		function tap.packet(pinfo,tvb,ip)
+			local llc_sapi = llc_sapi_get()
+			local llc_nu = llc_nu_get()
+			local bssgp_tlli = bssgp_tlli_get()
+
+			if not llc_sapi or not llc_nu or not bssgp_tlli then
+				return
+			end
+
+			local ip_src = tostring(ip.ip_src)
+			local bssgp_ttli = tostring(bssgp_tlli)
+			local llc_nu = tostring(llc_nu)
+			local llc_sapi = tostring(llc_sapi)
+
+			local src_key = ip_src .. "-" .. bssgp_ttli .. "-" .. llc_sapi
+			local last_nu = nu_state_src[src_key]
+			if not last_nu then
+				-- print("Establishing mapping for " .. src_key)
+				nu_state_src[src_key] = llc_nu
+				return
+			end
+
+			nu_state_src[src_key] = llc_nu
+			if tonumber(last_nu) + 1 ~= tonumber(llc_nu) then
+				print("JUMP in N(U) on TLLI " .. bssgp_ttli .. " and SAPI: " .. llc_sapi)
+				print("\t last: " .. last_nu .. " now: " .. llc_nu)
+			end
+		end
+
+		function tap.draw()
+		end
+
+		function tap.reset()
+		end
+	end
+	init_listener()
+end
+