Course Details
This course provides participants with a comprehensive exploration of using Wireshark to analyse and troubleshoot 5G networks across both core and radio access domains. Beginning with a recap of 5G functions and key protocols, learners will gain insights into 5G transport layers (IP, SCTP, TCP, UDP) and develop fluency in navigating Wireshark’s 5G-specific features, such as trace interaction, marking packets, and decoding encrypted traffic.
The course delves into essential 5G signalling protocols including NAS, NGAP, XnAP, F1AP, E1AP, HTTP/2, JSON, PFCP and GTP, highlighting their reference points, associations, and message flows within Wireshark. Through focused modules, students will visualise signalling and tunnelling mechanisms like GTPv1-U, as well as interworking with 4G on the N26 using GTPv2-C signalling.
The course culminates with end-to-end scenarios related to 5G Registration, PDU sessions, and data transfer. In so doing, equips learners with the skills to effectively decode, interpret, and troubleshoot real-world 5G traffic traces using Wireshark.

Philip Nugent
Mpirical TrainerIndividual Course
Course Contents
Introduction to Wireshark in 5G:
- Wireshark Introduction.
- Recap 5G Functions.
- Main 5G Core Protocols.
- RAN Protocols.
- IMS Protocols over 5G.
Transport Protocols in 5G:
- Layer 1 and Layer 2.
- IP (Internet Protocol).
- SCTP (Stream Control Transmission Protocol).
- TCP and UDP.
Wireshark Trace Interaction:
- Wireshark - 5G specific Menu Items .
- Wireshark - Columns.
- Wireshark - Find/Search.
- Wireshark - Marking Packets.
5G NAS Protocol:
- N1 Reference Point Messages.
- 5GMM and 5GSM Message Delivery.
- NAS in Wireshark.
- NAS Security Header.
- Wireshark - Decoding Null Encryption .
NGAP Protocol:
- N2 Reference Point.
- NGAP in Wireshark.
- NGAP Association.
XnAP Protocol:
- Xn Reference Point.
- XnAP Capabilities.
- XnAP Association.
- F1AP and E1AP Protocols:
- F1 Reference Point.
- F1AP Association.
- E1 Reference Point.
- E1AP Association.
5G SBI:
- 5G SBI (HTTP/2 and JSON).
- 5G SBI APIs in Wireshark.
- Wireshark - Decoding HTTP/2.
- HTTP/2 Magic.
- HTTP/2 Frames.
PFCP Protocol:
- N4 Reference Point.
- PFCP Messages.
- PFCP Session Correlation.
GTPv1-U Protocol:
- GTP Tunnels.
- Filtering for GTPv1-U.
- GTP Packet and Extension Header.
- User IPv6 Address.
5G End to End Wireshark Examples:
- Registration.
- PDU Sessions.
- Data Transfer.
GTPv2-C:
- GTPv2 Reference Point.
- Filtering for GTPv2 Messages.
- GTPV2 N26 Example.