MDT Data Collection with TCE

Trace Collection Entity (TCE)

RAN Monitor includes an integrated Trace Collection Entity for capturing and analyzing LTE/5G protocol messages. This enables detailed troubleshooting, drive testing, and RF optimization.

What is TCE?

The Trace Collection Entity receives trace data from Nokia AirScale base stations containing:

• S1-AP Messages - Control plane signaling between eNodeB and EPC
• RRC Messages - Radio Resource Control signaling
• NAS Messages - Non-Access Stratum signaling
• User Plane Data - PDCP layer throughput information

TCE Components

Component	Protocol	Port	Purpose
NSNTI Server	TCP	49151	Receives trace messages from base stations
TZSP Server	UDP	37008	Forwards traces to Wireshark for real-time analysis
Protocol Decoders	ASN.1	-	Decodes S1-AP and RRC messages

How It Works

The Trace Collection page shows active connections, NSNTI listen port (49151), TZSP configuration, and connected base stations.

Trace Collection Setup

1. Verify TCE is Running:

   ss -tlnp | grep 49151
   # Should show: LISTEN 0.0.0.0:49151

2. Configure Base Station Trace:

   • Set trace destination IP to RAN Monitor server
   • Set trace destination port to 49151
   • Enable trace categories (S1-AP, RRC, NAS as needed)
   • Start trace session

3. Configure Wireshark:

   Basic Setup:

   • Start capture on the interface receiving TZSP packets
   • Use capture filter: udp port 37008

   Protocol Decoding Configuration:

   RAN Monitor uses specific UDP ports to identify different protocol types and RRC channels. Configure Wireshark's "Decode As" feature to properly decode these protocols:

   Method 1: Using Wireshark GUI

   1. Go to Analyze → Decode As...
   2. Click the + button to add new entries
   3. Configure each row as follows:

   Field	Value	Type	Current	Decode As
   udp.port	36412	Integer	(none)	SCTP
   sctp.port	36412	Integer	(none)	S1AP
   udp.port	37000	Integer	(none)	TZSP
   udp.port	37001	Integer	(none)	LTE RRC (DL-CCCH)
   udp.port	37002	Integer	(none)	LTE RRC (DL-DCCH)
   udp.port	37003	Integer	(none)	LTE RRC (BCCH)
   udp.port	37004	Integer	(none)	LTE RRC (PCCH)
   udp.port	37008	Integer	(none)	TZSP
   udp.port	37011	Integer	(none)	LTE RRC (UL-CCCH)
   udp.port	37012	Integer	(none)	LTE RRC (UL-DCCH)
   udp.port	38000	Integer	(none)	MAC-LTE
   udp.port	38001	Integer	(none)	MAC-LTE (DL)
   udp.port	38002	Integer	(none)	MAC-LTE (BCH)
   udp.port	38003	Integer	(none)	MAC-LTE (PCH)
   udp.port	38011	Integer	(none)	MAC-LTE (UL)
   udp.port	38012	Integer	(none)	MAC-LTE (RACH)

   Method 2: Using decode_as_entries file

   Create or edit ~/.config/wireshark/decode_as_entries (Linux/Mac) or %APPDATA%\Wireshark\decode_as_entries (Windows):

   # RAN Monitor TZSP Port Mappings
   decode_as_entry: udp.port,36412,(none),SCTP
   decode_as_entry: sctp.port,36412,(none),S1AP
   decode_as_entry: udp.port,37000,(none),TZSP
   decode_as_entry: udp.port,37001,(none),LTE RRC
   decode_as_entry: udp.port,37002,(none),LTE RRC
   decode_as_entry: udp.port,37003,(none),LTE RRC
   decode_as_entry: udp.port,37004,(none),LTE RRC
   decode_as_entry: udp.port,37008,(none),TZSP
   decode_as_entry: udp.port,37011,(none),LTE RRC
   decode_as_entry: udp.port,37012,(none),LTE RRC
   decode_as_entry: udp.port,38000,(none),MAC-LTE
   decode_as_entry: udp.port,38001,(none),MAC-LTE
   decode_as_entry: udp.port,38002,(none),MAC-LTE
   decode_as_entry: udp.port,38003,(none),MAC-LTE
   decode_as_entry: udp.port,38011,(none),MAC-LTE
   decode_as_entry: udp.port,38012,(none),MAC-LTE

   Port Reference Guide:

   Port	Protocol	Channel/Type	Description
   36412	S1AP	-	Standard S1AP control plane (eNodeB ↔ EPC)
   37000	RRC	Generic	Fallback for unknown RRC channel types
   37001	RRC	DL-CCCH	Downlink Common Control Channel
   37002	RRC	DL-DCCH	Downlink Dedicated Control Channel
   37003	RRC	BCCH-DL-SCH	Broadcast Control Channel (System Information)
   37004	RRC	PCCH	Paging Control Channel
   37008	TZSP	-	Main TZSP listener port
   37011	RRC	UL-CCCH	Uplink Common Control Channel (RRC Connection Request)
   37012	RRC	UL-DCCH	Uplink Dedicated Control Channel (Measurement Reports)
   38000	MAC-LTE	Generic	Fallback for unknown MAC channel types
   38001	MAC-LTE	Downlink	Downlink Shared Channel
   38002	MAC-LTE	BCH	Broadcast Channel
   38003	MAC-LTE	PCH	Paging Channel
   38011	MAC-LTE	Uplink	Uplink Shared Channel
   38012	MAC-LTE	RACH	Random Access Channel

   Useful Display Filters:

   # Show all TZSP packets
   tzsp
   
   # Show specific protocols
   s1ap || rrc || mac-lte
   
   # Show only uplink RRC messages
   udp.port == 37011 || udp.port == 37012
   
   # Show only downlink RRC messages
   udp.port == 37001 || udp.port == 37002
   
   # Show RRC connection establishment
   rrc.rrcConnectionRequest || rrc.rrcConnectionSetup
   
   # Show handover messages
   s1ap.HandoverRequired || s1ap.HandoverCommand

Use Cases

Drive Testing:

• Capture end-user RF experience
• Analyze handover performance
• Measure signal quality (RSRP, RSRQ, SINR)
• Identify coverage holes

Troubleshooting:

• Debug call setup failures
• Analyze handover issues
• Investigate dropped calls
• Review mobility events

RF Optimization:

• PCI planning validation
• Neighbor relation optimization
• Handover parameter tuning
• Coverage and capacity analysis

Overview

Minimization of Drive Tests (MDT) allows you to collect radio measurements (RSRP, RSRQ, coverage data) directly from UEs without traditional drive testing. This guide shows you how to capture MDT data from Nokia AirScale base stations using the Omnitouch RAN Monitor Web UI and view it in Wireshark.

Architecture

The TCE (Trace Collection Entity) is integrated into the Omnitouch RAN Monitor and handles the conversion of Nokia-specific Ne3s protocol traces into standard formats viewable in Wireshark.

Prerequisites

Required Licenses

The Nokia Airscale requires feature activations including Per-Call Measurement Data to collect this data, and these features enabled and configured,

Contact ONS if you need help with licensing or have questions about your specific deployment.

System Requirements

• Omnitouch RAN Monitor with TCE running
• Wireshark 3.0+ installed on your machine
• TCE Lua plugins installed in Wireshark
• Network connectivity to the AirScale

Setting Up MDT Tracing

The TCE built into the RAN Monitor converts the incoming Nokia data into standard Wireshark viewable formats.

Step 1: Configure the Trace Collection Entity

Use the RAN Monitor Web UI to set up the base station to send traces to the TCE:

1. Open Web UI: https://<ran-monitor-ip>:9443
2. Navigate to Base Stations page
3. Click on the device you want to trace
4. Go to Configuration Management section
5. Download the current configuration (backup)
6. Edit the configuration to add/update TCE settings:
   • Trace Collection Entity IP: <Your RAN Monitor IP>
   • Trace Collection Entity Port: 49151
7. Upload the modified configuration
8. Validate the configuration (wait for validation to complete)
9. Activate the configuration

For help with specific configuration parameters or AirScale software versions, contact ONS.

Step 2: Configure MDT on the AirScale

Enable MDT tracing on your base station. Configuration options include:

• Trace Type: Immediate MDT (real-time) or Logged MDT (idle mode)
• Area Scope: Cell-specific, Tracking Area, or PLMN-wide
• Measurement Interval: How often UEs report (e.g., 5000ms)
• Measurement Type: RSRP, RSRQ, or both
• Trace Depth: Minimum, Medium, or Maximum

Contact ONS for guidance on configuring these parameters for your specific use case.

Step 3: Activate the Trace Session

Once configured, activate the trace session on the AirScale. The base station will begin sending MDT data to the TCE which in turn will forward it to your monitoring machine.

Viewing MDT Data in Wireshark

Setup Wireshark Capture

1. Start Wireshark on your machine
2. Capture on the loopback interface (lo on Linux, lo0 on macOS, Loopback on Windows)
3. Set capture filter: udp port 37008
4. Start capturing

Example Wireshark capture showing S1AP control plane messages (InitialUEMessage, Attach request), LTE RRC messages (RRCConnectionReject, RRCConnectionReestablishment), and various signaling flows captured via the TCE.

Filter for MDT Measurements

Once data is flowing, use these display filters:

# Show all RRC Measurement Reports
lte-rrc.measurementReport

# Show all uplink RRC messages
udp.dstport >= 37011 && udp.dstport <= 37012

# Filter by poor RSRP (< -100 dBm)
lte-rrc.rsrpResult < 40

# Filter by poor RSRQ (< -12 dB)
lte-rrc.rsrqResult < 22

Understanding the Data

MDT measurements appear as RRC MeasurementReport messages containing:

• Serving Cell Measurements: RSRP and RSRQ for the connected cell
• Neighbor Cell Measurements: RSRP and RSRQ for nearby cells
• Cell IDs: Physical cell IDs for correlation
• GPS Location: If configured and supported by UE

Expand the RRC message in Wireshark to see detailed measurements:

Radio Resource Control (RRC)
└─ UL-DCCH-Message
    └─ message: measurementReport
        └─ MeasurementReport
            └─ measResults
                ├─ measResultServCell (serving cell RSRP/RSRQ)
                └─ measResultNeighCells (neighbor cell measurements)

Export for Analysis

To analyze data offline:

1. File → Export Packet Dissections → As CSV
2. Include fields: lte-rrc.rsrpResult, lte-rrc.rsrqResult, lte-rrc.physCellId
3. Process in Excel, Python, or other tools

Common Use Cases

Coverage Analysis: Look for areas with weak RSRP/RSRQ

lte-rrc.rsrpResult < 40 || lte-rrc.rsrqResult < 22

Handover Analysis: See which neighbor cells UEs are reporting

lte-rrc.MeasResultListEUTRA

Interference Detection: Good RSRP but poor RSRQ indicates interference

lte-rrc.rsrpResult > 50 && lte-rrc.rsrqResult < 20

Troubleshooting

No data in Wireshark?

• Verify TCE is running: ps aux | grep beam
• Check Wireshark is capturing loopback with filter udp port 37008
• Confirm trace session is active on AirScale
• Verify TCE IP/port configured correctly on base station

Incomplete data?

• Check licenses are active (MDT + Per-Call Measurement)
• Increase trace depth to MAXIMUM
• Ensure UEs support MDT (LTE Release 10+)

For configuration help, licensing issues, or AirScale-specific questions, contact ONS.

Quick Start Checklist

• Verify MDT and per-call measurement licenses are active
• Configure TCE IP (RAN Monitor IP) and port 49151 on AirScale
• Start TCE on RAN Monitor server
• Activate MDT trace session on base station
• Start Wireshark capture on loopback with filter udp port 37008
• Apply display filter: lte-rrc.measurementReport
• Analyze measurements and export as needed

Support

• Omnitouch Network Services (ONS): For AirScale configuration, licensing, and deployment assistance