Quick Reference

Protocol Reference

Quick reference for telecom signaling protocols — ports, message types, and filter cheatsheets.

UDP 2123

GTP-C

GPRS Tunneling Protocol - Control

Creates, modifies, and deletes GTP tunnels for user plane data in 2G/3G/LTE networks.

Key Messages

Create PDP Context Req/Resp (16/17)

Update PDP Context Req/Resp (18/19)

Delete PDP Context Req/Resp (20/21)

Create Session Req/Resp (32/33)

Modify Bearer Req/Resp (34/35)

Delete Session Req/Resp (36/37)

Wireshark Filters

gtp

gtpv2.msg_type == 32

gtpv2.imsi == "001011234"

gtpv2.apn == "internet"

gtpu.teid == 0x12345678

TCP/SCTP 3868

Diameter

AAA Protocol for LTE

Authentication, Authorization, and Charging. Used across Gx, Gy, S6a, and S13 interfaces.

Interfaces

Gx — PGW/UGW to PCRF (Policy)

Gy — PGW/UGW to OCS (Online Charging)

S6a — MME to HSS (Auth)

S13 — MME to EIR (IMEI Check)

Wireshark Filters

diameter

diameter.cmd.ccr

diameter.result_code != 2001

diameter.application_id == 16777238

UDP 8805

PFCP

Packet Forwarding Control Protocol

5G Core protocol between SMF and UPF. Manages forwarding rules, QoS enforcement, and usage reporting.

Key Messages

Session Establishment Req/Resp (1/2)

Session Modification Req/Resp (3/4)

Session Deletion Req/Resp (5/6)

Heartbeat Req/Resp (128/129)

Wireshark Filters

pfcp

pfcp.msg_type == 1

pfcp.cause != 1

Over S1-AP / NG-AP

NAS

Non-Access Stratum

UE-to-core signaling carried over S1-AP (4G) or NG-AP (5G). Handles attach, authentication, and session management.

Message Types

Attach Request / Accept / Reject

Detach Request / Accept

TAU Request / Accept

Service Request

PDN Connectivity Request

Activate / Deactivate EPS Bearer

Wireshark Filters

nas_eps

nas_eps.emm_msg_type == 0x51

s1ap || ngap