Is there somewhere a SCAT recorded example PCAP file?

[capiman]

I have copied SCAT Python files to my embedded system.
I can record a *.pcap file from a Quectel RM520N-GL. This works.
When I now transfer the file from the embedded system to my Windows machine,
which has up-to-date (but unmodified) Wireshark, I can see data, but I am not sure,
if the data is correct and make sense.

So I am currently facing the problem to find out, if my recording and viewing sequence is correct,
or there is some error during recording and decoding in Wireshark.

Is there perhaps an example file which I can use to just load it in Wireshark.
And there is e.g. frame x where I shall see this and that?

Or shall I upload a short recorded file and uploaded it, so someone else can verify if my recording is correct?

[capiman]

The output of SCAT itself does not look that wrong:

root@triorail-phyboard-pollux-imx8mp-3:~# scat -t qc -s /dev/ttyUSB0 -f x --events -F test.pcapng | grep "NR RRC"
Radio 0: NR RRC SCell Info: NR-ARFCN: 372750/352106, Bandwidth: 25/25 MHz, Band: 3, PCI:  306, MCC: 262, MNC: 02, xTAC/xCID: bbcb/83e40de
Radio 0: NR RRC OTA Packet: NR-ARFCN: 372750, PCI: 306, Type: 15
Radio 0: NR RRC OTA Packet: Body: 39a469220a4c0217f28040
Radio 0: NR RRC OTA Packet: NR-ARFCN: 372750, PCI: 306, Type: 17
Radio 0: NR RRC OTA Packet: Body: 02e020131af081b6919010164a6a
Radio 0: NR RRC OTA Packet: NR-ARFCN: 372750, PCI: 306, Type: 18
Radio 0: NR RRC OTA Packet: Body: 46a000c9ec2bc58478b06f13fde221bc5cd78888f14f1e2e18c3c35500709f5dde201bc4a278a34f1115e22bbc4db78988f170c61e1a8805915c318786aa03139e26bc42278896f12e9e2c1bc45d7894cf1349e1d98c3c3520

which seems to be different SIBs.

[capiman]

Do I need scat.lua to decode the messages?
What to do with this file in my Wireshark installation (on Windows, in my case even on a Windows ARM64)?
Copy it somewhere? Import it somehow inside Wireshark?

[rtommy]

Could you please share your pcap file for reproduction and analysis?

What do you think might be different or wrong in the Wireshark representation?

[lucaslima782]

Do I need scat.lua to decode the messages? What to do with this file in my Wireshark installation (on Windows, in my case even on a Windows ARM64)? Copy it somewhere? Import it somehow inside Wireshark?

You do. Wireshark does not know which dissectors to use without it. If you go to Help>About Wireshark>Folders you can check which folders your Lua Scripts should be (Global or Local). Just put the scat.lua in one of those folders, and wireshark will use it.

[capiman]

Many thanks! This was the solution! I was missing to install scat.lua. After doing it I now see commands like
"RRC Setup Request", "RRC Setup", "RRC Setup Complete", ...

Perhaps it would be a good idea to add this info to main page of SCAT, because scat.lua is existing as file in github,
but never described for what it is used for and what to do with it.

[peremen]

I can update the README to explain more on the Lua plugin.

[capiman]

106567	3031.161824	192.168.177.131	192.168.177.29	NR RRC	86	MIB

This is great!

106606	3031.684328	192.168.177.131	192.168.177.29	GSMTAP	162	Event 3240: 0x2 0x11

What can I do with such data packets? Is there still some decoding missing?
Or if not directly useful data: Can I ignore it somehow?
I think I am missing the experience, to decide if correct and what it means.

Details view of this above data packet:

Frame 106606: Packet, 162 bytes on wire (1296 bits), 162 bytes captured (1296 bits) on interface \Device\NPF_{084BD5D5-2717-4EDF-ABC3-46D349D70266}, id 0
    Section number: 1
    Interface id: 0 (\Device\NPF_{084BD5D5-2717-4EDF-ABC3-46D349D70266})
        Interface name: \Device\NPF_{084BD5D5-2717-4EDF-ABC3-46D349D70266}
        Interface description: Qualcomm FastConnect 7800 Wi-Fi 7 Dual Band Simultaneous (DBS) Network Adapter
    Encapsulation type: Ethernet (1)
    Arrival Time: Feb 20, 2026 10:24:57.159023000 Mitteleuropäische Zeit
    UTC Arrival Time: Feb 20, 2026 09:24:57.159023000 UTC
    Epoch Arrival Time: 1771579497.159023000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 50 minutes, 31.684328000 seconds]
    Frame Number: 106606
    Frame Length: 162 bytes (1296 bits)
    Capture Length: 162 bytes (1296 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:gsmtap_extra:gsmtap:gsmtap_log]
    Character encoding: ASCII (0)
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: ASIXElectron_c8:eb:eb (c8:a3:62:c8:eb:eb), Dst: CloudNetwork_5a:dc:5b (58:cd:c9:5a:dc:5b)
Internet Protocol Version 4, Src: 192.168.177.131, Dst: 192.168.177.29
User Datagram Protocol, Src Port: 44694, Dst Port: 4729
    Source Port: 44694
    Destination Port: 4729
    Length: 128
    Checksum: 0x3c67 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 2]
    [Stream Packet Number: 17972]
    [Timestamps]
    UDP payload (120 bytes)
GSM TAP Header
    Version: 2
    Header Length: 16 bytes
    Payload Type: libosmocore logging (16)
GSMTAP libosmocore logging Event(3240): /0: :0 Event 3240: 0x2 0x11
    Timestamp: Jan  6, 1980 02:07:37.519396000 UTC
    Application: Event
    Process ID: 3240
    Log Level: Unknown (0)
    Subsystem: 
    Source File Name: 
    Source File Line Number: 0
    String: Event 3240: 0x2 0x11
Extra analysis of the GSMTAP protocol
    Subtype: 0 (Unknown)

[peremen]

What can I do with such data packets? Is there still some decoding missing?
Or if not directly useful data: Can I ignore it somehow?

This is the expected behavior when you specified the --events switch. Qualcomm DIAG uses multiple packet types, events are compact indicator on what is happening on the baseband. Not all events have their definition available, so if the event number is unknown, it will just show the event ID as number and any following arguments. Just drop the --events switch if it is not needed. And please do not rely on AI slop for something you don't know by heart.

[capiman]

Many thanks for clarification! It worked. I am new to SCAT and learn a lot from answer to answer.