Capturing UE User-Plane Traffic on Rogue Base Stations

1. From Rejection to Acceptance: Completing the Attach

In our IMSI catch, we ensured our rogue core network's database (user_db.csv) was empty. This caused the authentication to fail, but not before the UE sent us its IMSI.

To capture user data, we need the UE to establish a data bearer, which only happens after a successful authentication. Therefore, our first step is to modify our rogue network to legitimately authenticate our test UE.

You will need to:

1. Locate the user_db.csv file used by your rogue srsepc instance.
2. Add a line to this file with your test SIM card's credentials: its IMSI, authentication key (K), and operator code (OPc). The format is IMSI,key,opc,sqn,amf. You can leave sqn and amf as zeroes.

By providing these details, your rogue srsepc can now perform the Authentication and Key Agreement (AKA) procedure correctly, generate the necessary security keys, and allow the UE to fully attach.

2. Establishing the User Plane and the GTP Tunnel

Once authentication and security setup are complete, the network's final step is to establish a path for the UE's data to travel to and from the internet. This path is called the user plane.

In 4G/5G networks, the user plane is not a direct connection. Instead, IP packets from the UE are wrapped inside another protocol called the GPRS Tunneling Protocol (GTP). Think of it as a dedicated VPN tunnel for each user's data session, running between the base station (eNB) and the core network's gateway (PGW).

This process involves several steps where the MME orchestrates the creation of this tunnel. The video below provides an excellent overview of how the bearers are set up and how GTP tunnels are established with unique Tunnel Endpoint Identifiers (TEIDs).

The key takeaway is that your UE's internet traffic (like DNS queries or HTTP requests) will be encapsulated within GTP-U (User Plane) packets as it travels between your srsenb and srsepc. To intercept the data, we need to capture this tunnel.

3. Configuring srsRAN to Capture the GTP Tunnel

Fortunately, srsRAN makes it easy to capture traffic at various points in the protocol stack. In the last lesson, you enabled MAC and S1AP captures. Now, we will specifically enable the capture for the GTP-U interface.

The following guide explains how to enable packet captures for different layers in srsRAN. We'll apply this to our rogue eNB.

Your enb_rogue.conf file should now have a [pcap] section that looks something like this:

[pcap]
enable = true
mac_net_enable = true
mac_filename = /tmp/enb_mac.pcap
gtpu_enable = true
gtpu_filename = /tmp/enb_gtpu.pcap

This configuration tells srsenb to write all user plane traffic that passes through the GTP tunnel into the /tmp/enb_gtpu.pcap file.

4. Execution: Capturing Live User Data

Now, let's put everything together and capture some traffic.

Execution Steps:

1. Prepare the UE: Ensure your test UE is ready and its SIM credentials are in the rogue user_db.csv.
2. Start the Rogue Core: In a terminal, launch your rogue EPC with the updated user database.
   sudo srsepc --epc.conf ~/.config/srsran/epc_rogue.conf
3. Start the Rogue Base Station: In a second terminal, launch your rogue eNB with the updated PCAP configuration.
   sudo srsenb --enb.conf ~/.config/srsran/enb_rogue.conf
4. Connect and Generate Traffic:
   • Let the UE connect to your rogue network. You should see logs in the srsepc and srsenb terminals indicating a successful attach procedure. The UE should now have a data connection.
   • On the UE, generate some unencrypted internet traffic. A simple way to do this is to open a web browser and visit an http (not https!) website, like http://neverssl.com, or run a ping to a public server (ping 8.8.8.8).
5. Stop the Capture: After generating some traffic, stop srsenb and srsepc (Ctrl+C in each terminal). The /tmp/enb_gtpu.pcap file now contains the captured user data.

5. Initial Analysis in Wireshark

Open your /tmp/enb_gtpu.pcap file in Wireshark. At first glance, it might just look like a stream of UDP packets. This is because GTP-U is encapsulated over UDP.

1. Apply a filter: In the display filter bar, type gtp and press Enter. This will show you only the GTP traffic.
2. Inspect a packet: Click on any packet. In the packet details pane, you will see the protocol stack:
   • Frame
   • Ethernet II
   • Internet Protocol Version 4 (This is the outer IP header, between eNB and EPC)
   • User Datagram Protocol (GTP is carried over UDP)
   • GPRS Tunnelling Protocol (This is the tunnel header, with the TEID)
   • Internet Protocol Version 4 (This is the inner IP packet from your UE!)
   • Internet Control Message Protocol (If you ran a ping) or TCP (if you visited a website).

You have successfully captured user-plane traffic! You are looking at the raw IP packets sent by the UE, neatly encapsulated in the GTP tunnel you intercepted.

Conclusion

In this lesson, you elevated your rogue base station from a passive identifier to an active man-in-the-middle platform. You learned how to complete the UE authentication process and leveraged that to intercept the user's data stream.

Key Takeaways:

• To capture user-plane traffic, the rogue network must successfully authenticate the UE by having its credentials in the HSS (user_db.csv).
• User data in LTE is transported within GTP-U tunnels between the eNodeB and the core network gateways.
• srsRAN can be configured to capture the GTP-U interface directly to a PCAP file (gtpu_enable = true).
• Analyzing this capture in Wireshark reveals the UE's original IP packets encapsulated inside the GTP tunnel.

Preview of the Next Lesson:

You now have a PCAP file containing the UE's raw data. In the next lesson, "Analyze captured traffic to identify unencrypted data like DNS queries or HTTP requests," we will move beyond just identifying the traffic. You will learn to use Wireshark's powerful tools to filter, follow streams, and extract sensitive, cleartext information from your capture.