WIRESHARK LUA PLUGIN ·

See the whole GTP session, not just the packet.

GTP Session Tracker correlates GTPv1-C, GTPv2-C, GTP-U (G-PDU) and PFCP messages into logical sessions — like Wireshark's SIP dialog and VoIP call tracking — so a complete session can be isolated with a single display filter. It also flags common 3GPP TS 29.060 / 29.274 / 29.244 conformance problems that the stock dissectors parse without complaint.

DOWNLOAD .LUA ↗ WATCH TUTORIAL ▶

Single Lua file · runs inside Wireshark · GUI menus and tshark fields

GTPv1-CGTPv2-CGTP-UPFCP

01 / ONE SESSION, ONE FILTER

Control plane, user plane and PFCP merged into one id.

GTPv2-C, GTPv1-C, GTP-U and the PFCP leg that provisioned the same F-TEID / F-SEID are merged into one canonical session id, so gtpsess.session == N shows the whole session across all three protocols. Sessions related only by UE IP or a shared tunnel are listed as related sessions.

ANOMALY DETECTION

Problems appear in Expert Information.

Every anomaly is raised as a Wireshark expert item and written to gtpsess.violation as a short code, so it can be filtered, coloured, or counted like any other field.

RETRANSMISSIONSame sender, message type and sequence number within a configurable window (default 30 s)

ORPHAN RESPONSEResponse with no matching request in the capture

TEID ZEROSession-initiating request with a TEID unknown to the receiver (TS 29.274 7.2.1 / TS 29.060 7.3.1)

TEID COLLISIONControl TEID reused at an IP while the previous session is still open

PROCEDURE FAILEDProcedure completed with a non-acceptance Cause

UNKNOWN GTP-UG-PDU with a TEID not announced by any earlier control-plane message

PFCP SEIDSession Establishment Request without SEID=0 in the header (TS 29.244 7.2.2.4.1)

HANDOVERGTP-U endpoint of the session changed (handover / path switch)

FIELDS & MENUS

What the plugin adds to Wireshark.

Each frame is analysed once after the file is opened or reloaded and the result is cached, so fields and expert items stay stable across clicks, filters, and the Expert Information dialog.

Fields

gtpsess.session: Canonical session id (merged across protocols)
gtpsess.leg: Per-protocol leg id before the merge
gtpsess.linked: Sessions related by UE IP or shared tunnel
gtpsess.role / plane / state: Procedure, plane, and session state after the message
gtpsess.imsi / apn: Session IMSI and APN/DNN
gtpsess.handover: On the message that moved a GTP-U endpoint
gtpsess.violation: Short code of every anomaly on the packet

Menus

Tools: GTP-PFCP Session Tracker > Session Analysis — summary of sessions, protocol legs, states, unrecognised GTP-U TEIDs, and per-session frames and duration
Tools: GTP-PFCP Session Tracker > Reset and reload
Packet list: Right-click > Apply GTP/PFCP session filter
Preferences: Retransmission window (seconds)
tshark: Use -2 -R frame to get merged session ids on every frame

INSTALL & USE

Installation and file integrity.

No installer and no separate runtime: the plugin is one Lua file loaded by Wireshark.

Install

1. Download: gtp_session_tracker_v2.lua from Dropbox
2. Copy: Into your Personal Lua Plugins folder (Help > About Wireshark > Folders): typically %APPDATA%\Wireshark\plugins on Windows or ~/.local/lib/wireshark/plugins on Linux
3. Load: Analyze > Reload Lua Plugins (Ctrl+Shift+L) or restart Wireshark
4. Use: Open a capture with GTP / PFCP traffic, right-click a packet > Apply GTP/PFCP session filter, or open Tools > GTP-PFCP Session Tracker > Session Analysis

File and SHA-256

File	Size	SHA-256
gtp_session_tracker_v2.lua (v2.0, 2026-10-22)	53.0 KB	`b9371913b817257fb242f64db13e133d1a55a7c149f14de368d4f3dd59b91912`

Questions: undefinable@yandex.com.

READY TO TRACK

From a raw capture to a readable session.

Watch the tutorial, drop the file into Wireshark, and filter your first session.

WATCH TUTORIAL ▶DOWNLOADS →