Tools used:

 lteflowfox.pl (download from Flowfox website)

 multimon.pl (included with LTE Flowfox)
 LTNG decoder (included with LTE Flowfox)
 router & viewer (included with LTE Flowfox)

Enable traces and monitor (from moshell):

tm -udp [O&M Tool Server IP Address]
tm -attach 2 000100 gcpu00256 gcpu00512 gcpu00768 gcpu01024
tm -save

te e bus_send bus_receive Ft_RRC_ASN

te e bus_send bus_receive Ft_S1AP_ASN
te e bus_send bus_receive Ft_X2AP_ASN
te e all LTE_EXCEPTION

te save Ft_RRC_ASN
te save Ft_S1AP_ASN
te save Ft_X2AP_ASN
te save LTE_EXCEPTION

Enable selective UE tracing (default timeout of trace is 120 minutes, can be increased to 720 minutes)
ue enable -allcell -allUe
ue enable -allcell -allUe -timeout 720

View live flow (from server):

nohup router &
nohup viewer --monitor=[eNB IP Address] | multimon.pl [eNB Cell ID] >>
joined_output_logfile.log &
tail -f joined_output_logfile.log | ltng -s | lteflowfox.pl -lac

View live flow of multiple nodes (from server):

nohup viewer --monitor=[eNB IP Address 1] | multimon.pl [eNB Cell ID 1] >>
joined_output_logfile.log &
nohup viewer --monitor=[eNB IP Address 2] | multimon.pl [eNB Cell ID 2] >>
joined_output_logfile.log &
nohup viewer --monitor=[eNB IP Address 3] | multimon.pl [eNB Cell ID 3] >>
joined_output_logfile.log &
tail -f joined_output_logfile.log | ltng -s | lteflowfox.pl -lac

Create HTML report for post analysis (from server):

cat output_logfile.log | ltng -s > output_decoded_logfile.log
lteflowfox.pl -f output_decoded_logfile.log

Create HTML report for customer presentation (from server):

cat output_logfile.log | ltng -s > output_decoded_logfile.log
lteflowfox.pl -f output_decoded_logfile.log -C

Decode baseband traces (from server):

Configure ltelogtool using this guide.
tail -f joined_output_logfile.log | ltelogtool -application logtool.console -nosplash
-s | lteflowfox.pl -lac

Using ltng to decode PCAP files

LTNG can directly decode traces captured in a PCAP format (e.g. Wireshark's dumpcap or COLI dumpcap
command). These traces are captured directly from an interface and do not require router/viewer.

Use or Capture a PCAP file using some IP capture tool (e.g. Wireshark's dumpcap tool):

 ~/> dumpcap -i eth0 -f "host [OAM IP address of eNB] and udp port33078" -w
logfile.pcap

Use CTRL+c to close the log once data is captured.

Unpack and decode the capture to screen using LTNG:

 ~/> ./ltng -f logfile.pcap

Using multimon.pl to display flow from multiple eNodeB's

If we want to see handover between 2 or more cells, we need to run the monitor and enable the traces
on each node. This is necessary, however using multimon.pl we can view one single flow for multiple
trace streams. Multimon will add the eNodeB ID to every message, this way, Flowfox knows which
eNodeB the message is coming from, and label it.

Procedure:

1. Enable monitor and traces on all nodes intended for monitoring.

2. Run viewer on the server for each node with this command. The stream each node is decoded
and eNodeB ID added to each message, and then appended to a joined logfile:
o ~/> nohup router &

o ~/> nohup viewer --monitor=[eNB IP Address 1] | multimon.pl [eNB Cell ID

1] >> joined_output_logfile.log &

o ~/> nohup viewer --monitor=[eNB IP Address 2] | multimon.pl [eNB Cell ID

2] >> joined_output_logfile.log &
 o ~/> nohup viewer --monitor=[eNB IP Address 3] | multimon.pl [eNB Cell ID
3] >> joined_output_logfile.log &

3. Finally, run LTNG and lteflowfox on the joined file:

o ~/> tail -f joined_output_logfile.log | ltng -s | lteflowfox.pl –lac

Generating customer friendly flow

LTE Flowfox can also hide the message details, and present the flow with only message names, and some
common parameters. Also, we can choose to hide the non-ASN entries (indicated in white colour). This
can be handy if the flow is to be presented to the customer. This can be done with the following
commands:
1. ~/> cat output_logfile.log | ltng -s > output_decoded_logfile.log
2. ~/> lteflowfox.pl -f output_decoded_logfile.log --cust

Flowfox will produce the following result: