Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 11

Decoding LTE MIB and SIB Messages

Recommended resources

Introduction

Welcome back. In our last lesson, you successfully used LTE-Cell-Scanner to discover the active 4G LTE base stations (eNodeBs) in your vicinity, identifying them by their EARFCN and Physical Cell ID (PCI). This was the crucial first step in passive reconnaissance: finding the targets.

Today, we'll take the next step by tuning into one of these cells to understand what it's broadcasting. This lesson directly addresses the learning outcome: Decode LTE Master Information Block (MIB) and System Information Block (SIB) messages. These messages are the eNodeB's public broadcast, containing everything a phone needs to know to join the network. For a security researcher, this information is a goldmine, forming the foundation for network fingerprinting and vulnerability analysis.

We will cover the theory behind MIB and SIBs, explore the specific information they contain, and then use your Wireshark skills to analyze a real-world capture of these messages.

1. The System Information Hierarchy: MIB and SIBs

An LTE base station constantly broadcasts essential network parameters so that phones can discover and connect to it. This isn't a single, monolithic message but a structured hierarchy of information blocks.

The process starts with the Master Information Block (MIB). The MIB is the most fundamental message, broadcast on a fixed schedule over the Physical Broadcast Channel (PBCH). A phone turning on will first search for and decode the MIB.

However, the MIB only contains the bare essentials. Its primary job is to provide the phone with just enough information to find and decode System Information Block Type 1 (SIB1). SIB1 is the gateway to all other system information. It contains crucial parameters about cell access and, most importantly, provides the scheduling information for all other SIBs (SIB2, SIB3, etc.). These subsequent SIBs are transmitted on the Downlink Shared Channel (DL-SCH).

This hierarchical structure is efficient: the phone gets the MIB, then SIB1, and then it knows when and where to listen for the rest of the details it needs.

LTE System Information Block (SIB) Transmission and Periodicity
This diagram illustrates the LTE system information hierarchy. The eNodeB transmits the MIB, which enables the UE to find SIB1. SIB1, in turn, provides the schedule for all other SIBs, which are grouped into different System Information (SI) messages with varying periodicities.

To get a more detailed understanding of the role and content of each block, please watch the following video.

LTE Tutorial (Part 3) LTE MIB and SIBs

The video 'LTE MIB and SIBs' from the LTE Plus Plus channel provides a clear, step-by-step explanation of what MIB and SIBs are, the channels they're transmitted on, and the key information each one carries.

Please watch the video from 00:42 to 13:38. Focus on understanding: The content and periodicity of the MIB (02:14). The crucial role of SIB1 in scheduling other SIBs and its key contents, like cell access/selection info (05:55). The mandatory nature of SIB2 and the RACH/paging information it provides (11:47). The general purpose of SIBs 3 and beyond, which primarily handle cell reselection for idle UEs (13:38).

2. What's Inside? The Information Elements

Now that you understand the structure, let's dive into the specific data fields, known as Information Elements (IEs), that these blocks contain. From a security perspective, these IEs can be used to "fingerprint" a base station's hardware or software vendor, potentially revealing known vulnerabilities.

A research paper on this topic provides an excellent, concise list of the most important IEs found in SIB1 and SIB2. We'll use its appendix as a reference guide.

Fingerprinting of Cellular Infrastructure based on Broadcast Information

This paper, 'Fingerprinting of Cellular Infrastructure based on Broadcast Information', demonstrates how the broadcast messages we are studying can be used for security analysis. We will focus on the appendix, which lists and describes the specific data fields from SIB1 and SIB2.

First, briefly read Section 4.2 'Listening' (page 7) to see how researchers capture SIB1 and SIB2 to get the information a UE needs. This reinforces why these messages are so important. Then, turn to the 'Appendix' on page 20. Read through the list of features and their descriptions. You don't need to memorize them, but familiarize yourself with key IEs like: qrxlevmin: The minimum signal strength a phone needs to consider the cell. plmn-IdentityList (found within SIB1): The operator's identity (e.g., Verizon, T-Mobile). cellBarred: A flag indicating if the cell is available for general use. RACH parameters (like rootSequenceIndex, prach-ConfigIndex): Technical details for how a phone initiates contact.

This list will serve as our "dictionary" when we look at a real packet capture.

3. Hands-On Lab: Decoding SIBs in Wireshark

In a later module, you will install the srsRAN software suite to build your own 4G network. A component of this suite, srsUE, can capture live SIBs. For today, to keep the focus purely on decoding, we will use a pre-existing capture file. This allows us to jump straight into the analysis with your tool of choice, Wireshark.

The process involves two steps: configuring Wireshark to correctly dissect LTE RRC protocols and then analyzing the capture file to identify the SIBs and their contents.

Step 1: Configure Wireshark for LTE

By default, Wireshark may not know how to interpret the specific packet format used for LTE radio captures. The following video demonstrates how to configure the necessary protocols. While the video discusses a capture tool (LTESniffer) that we are not using, the Wireshark setup steps are precisely what we need.

LTESniffer: How To Install And Configure A Practical 4G Downlink Decoder In DragonOS FocalX

This video demonstrates how to configure Wireshark to decode LTE control plane traffic. We will follow its instructions to prepare Wireshark for our analysis.

Watch carefully from 15:15 to 18:20. Follow the presenter's actions to configure your Wireshark installation: Go to Edit > Preferences > Protocols. Scroll down to DLT_USER and click Edit. Click + to add a new entry. Set User 0 (DLT=147) to the protocol mac-lte-framed. Click OK to close the DLT_USER window and OK again to close Preferences. Go to Analyze > Enabled Protocols. In the search bar, type lte. Ensure that mac_lte_udp, pdcp_lte_udp, and rlc_lte_udp are all checked. If you can't find them, try enabling mac-lte, pdcp-lte, and rlc-lte. The exact names may vary slightly with Wireshark versions. Click OK. Your Wireshark is now ready to decode LTE radio traffic.

Step 2: Analyze the SIB Capture

The author of the article Viewing the SIB – The LTE System Information Block with SDRs provides a sample packet capture containing LTE SIBs.

  1. Download the capture file from this link (this link is from the resource LINK).
  2. Open the file (srsUE_To_read_SIB.pcap) in your newly configured Wireshark.
  3. Apply a display filter to isolate the system information messages. Type lte-rrc.bcch_dl_sch_message into the filter bar and press Enter.

You should now see a list of packets, each containing a BCCH-DL-SCH-Message. This is the container for the System Information Blocks.

LTE System Information Block (SIB) Structure in RRC Protocol
This is what you're looking for. The Wireshark packet details pane shows a tree structure for the `BCCH-DL-SCH-Message`, expanded to reveal `systemInformationBlockType1` (SIB1) and other SIBs.

Your task:

  • Select a packet containing systemInformationBlockType1. Expand the lte-rrc protocol tree in the packet details pane.
  • Explore the contents of SIB1:
    • Find the plmn-IdentityList. Can you identify the Mobile Country Code (MCC) and Mobile Network Code (MNC) of the operator?
    • Check the cellAccessRelatedInfo. Is the cellBarred status set to notBarred?
    • Locate the si-SchedulingInfo. Notice how it defines the periodicity and SIB mapping for other SI messages.
  • Now find a packet containing SIB2.
    • Expand its contents and look for the rach-ConfigCommon. Cross-reference the IEs you see (e.g., preambleInitialReceivedTargetPower, powerRampingStep) with the descriptions in the research paper's appendix.

This exercise directly connects the theory of MIBs and SIBs to the practical, decoded data that forms the basis of any further 4G analysis.

Conclusion

Fantastic work. You have moved beyond simply finding LTE cells to actively decoding and understanding their broadcasted "blueprints." This is a fundamental skill in cellular security reconnaissance.

Key Takeaways:

  • LTE system information is broadcast in a hierarchy, starting with the MIB, which points to SIB1, which in turn schedules all other SIBs.
  • SIB1 contains critical information about cell identity (PLMN) and access restrictions (cellBarred).
  • SIB2 contains essential radio resource configurations needed for a device to initiate a connection, such as Random Access Channel (RACH) parameters.
  • With the right configuration, Wireshark is a powerful tool for dissecting captured LTE traffic and examining the specific Information Elements (IEs) within each SIB.

Preview of the Next Lesson:
Today, you learned how to decode the full range of broadcast information. In the next lesson, "Interpret the security and capability information broadcast by LTE cells," we will narrow our focus. You will learn to sift through these SIBs specifically for the Information Elements that describe the cell's security mechanisms, or lack thereof, moving you one step closer to identifying potential weaknesses.