{
  "id": 7424811,
  "title": "Reading an IMS voice call out of a GTP-only 5G capture",
  "url": "https://urgent.news/2026/09/14/reading-an-ims-voice-call-out-of-a-gtp-only-5g-capture",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T23:31:26.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/eventhelix/reading-an-ims-voice-call-out-of-a-gtp-only-5g-capture-iek"
  },
  "original_language": "en",
  "account": "A bug report from an srsRAN tool describes a 5G base station F1-U interface capture that appears to contain only GTP protocol data units (PDUs). However, within these GTP-U tunnels lie PDCP PDUs, which decode to reveal a two-party VoNR call. The inner IPv4 packets become visible after removing the three-byte PDCP payload header from each T-PDU. The reconstructed capture reveals 1,670 RTP frames, 273 TLS connections, 208 IPsec ESP packets, 59 DNS queries, 14 RTCP packets, and six SIP messages.\n\nThe six SIP messages include a REGISTER with an empty Authorization digest, a 100 Trying response, a 401 Unauthorized with a WWW-Authenticate header specifying the encryption algorithm and nonce, and the expected IPsec parameters. The first ESP packet arrives about half a second after the 401, confirming the match between the IMS-AKA challenge and the corresponding security association. This demonstrates how the SIP signaling and media plane are negotiated together using IPsec, with RTP media flowing inside the secure ESP tunnel. The reconstruction of this VoNR call was possible because the payload was unencrypted, a test-rig choice that would not be possible on a commercial network using stronger encryption methods like NEA1 or NEA2.",
  "summary": "An srsRAN bug report describes a capture taken on a 5G base station's F1-U interface that decodes as nothing but GTP. The SIP signaling and the RTP voice are simply not there — Wireshark shows GTP tunnels and stops. They are there. F1-U carries PDCP PDUs inside GTP-U tunnels, and in this lab build, PDCP runs the NEA0 null cipher with no SDAP header, so the inner IP packet starts at a fixed 3-byte…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}