[srslte-users] Possible to sniff Attach Requests?

[David Rupprecht]

Hi,

you can use srsLTE/lib/examples/pdsch_ue.c to listing to the cell's
paging requests setting the rnti=P-RNTI. This was first described in
[1]. For further Downlink analyses, you can use Airscope an srsLTE based
downlink analyzer [2]. Sniffing the Attach Request is a bit more
difficult, as they are send in uplink direction. For injecting paging
traffic the UE must be synchronized to the your PSS and SSS. For more
information you can read [1] or [3].

Best regards,
David


[1] https://arxiv.org/pdf/1510.07563.pdf
[2] http://www.softwareradiosystems.com/products/
[3] https://comsecuris.com/papers/UMTSprivacy.pdf

On 09.11.18 16:02, Dylanger Daly wrote:
> Hey Guys,
> 
> Apologies if this is the wrong way to start threads, I've never used a
> mailing list before.
> 
> Is it possible to modify srsUE and sniff Paging Requests along side
> Attach Requests from other UEs?
> 
> I'm wanting to pickup the DRX_Cycle (Paging Cycle) for all UEs that
> attach, it's my understanding this parameter is set in the Attach
> Request, as well as SIB.
> 
> Knowing this information, it _should_ be possible to then
> transmit/inject Paging Messages to that UE, does anyone know if this is
> possible?
> 
> Thank you very much! Any help is greatly appreciated :)
> 
> _______________________________________________
> srslte-users mailing list
> srslte-users at lists.softwareradiosystems.com
> http://www.softwareradiosystems.com/mailman/listinfo/srslte-users
> 

-- 
M.Sc. David Rupprecht

Ruhr-University Bochum
Research Group Information Security
Universitätsstraße 150
ID 2/130
44780 Bochum / Germany

Phone: +49 234 / 32 - 23508
Web: www.infsec.rub.de