Cellular layer3 tracing possibility for Qualcomm based modules (2G/3G/4G,LTE-M,NB-IoT)

I want to share a tool which I love and I think it will be very useful for many of you using a cellular module which has a Qualcomm based chipset (like EXS82 and ENS22 from Thales or BG95,BG96 from Quectel or uBlox Sara R410 etc.).
There is even a cheap LTE dongle available having an open diagnostic port.

This free tool is called QCSuper available on Github.

It is a python based tool which is able to decode the debug interface stream.
A simple call like:

./qcsuper.py --usb-modem /dev/ttyUSB0 --wireshark-live --decrypt-nas --reassemble-sibs --include-ip-traffic

and a working wireshark installation is enough to start it.
It will show you all the NAS messages, SIBs, pagings - all the messages which are sent over the air to your next cell tower.
For some modules, the needed dignostic port (DM port) needs to be enabled by some extra at-cmds.
For Quectel it is e.g.:

to enable modem log , pls send AT+QCFG="dbgctl",0
to disbale modem log ,pls send AT+QCFG="dbgctl",1

This is how it looks like in Wireshark:

2 Likes