{"id":13791335,"url":"https://github.com/fgsect/scat","last_synced_at":"2026-03-09T04:32:53.719Z","repository":{"id":39708002,"uuid":"139310283","full_name":"fgsect/scat","owner":"fgsect","description":"SCAT: Signaling Collection and Analysis Tool","archived":false,"fork":false,"pushed_at":"2026-02-19T23:31:06.000Z","size":920,"stargazers_count":476,"open_issues_count":13,"forks_count":118,"subscribers_count":37,"default_branch":"master","last_synced_at":"2026-02-20T02:26:15.428Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fgsect.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2018-07-01T07:51:36.000Z","updated_at":"2026-02-19T23:31:10.000Z","dependencies_parsed_at":"2023-02-14T02:15:24.179Z","dependency_job_id":"e2fd2ea3-b3bf-420e-86fd-e478aff28a43","html_url":"https://github.com/fgsect/scat","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/fgsect/scat","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fgsect%2Fscat","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fgsect%2Fscat/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fgsect%2Fscat/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fgsect%2Fscat/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fgsect","download_url":"https://codeload.github.com/fgsect/scat/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fgsect%2Fscat/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30283425,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-09T02:57:19.223Z","status":"ssl_error","status_checked_at":"2026-03-09T02:56:26.373Z","response_time":61,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T22:00:58.986Z","updated_at":"2026-03-09T04:32:53.694Z","avatar_url":"https://github.com/fgsect.png","language":"Python","funding_links":[],"categories":["UE","Software and Tools","Wireless Protocols","Python"],"sub_categories":["Diagnostics, Monitor mode","Analysis Tools","Cellular (GSM/LTE/5G)"],"readme":"# SCAT: Signaling Collection and Analysis Tool\n\nThis application parses diagnostic messages of Qualcomm and Samsung baseband\nthrough USB, and generates a stream of GSMTAP packet containing cellular control\nplane messages.\n\n## Requirements\n\n### On PC\n\nOnly tested in Linux, mostly various versions of Ubuntu.\nPython 3.7 is a minimum requirement, and the following external modules are required:\n\n* [pyUSB](https://pypi.org/project/pyusb/)\n* [pySerial](https://pypi.org/project/pyserial/)\n* [bitstring](https://bitstring.readthedocs.io/en/stable/)\n* [packaging](https://pypi.org/project/packaging/)\n* [libscrc](https://github.com/hex-in/libscrc) - optional\n\nTo properly decode 2G/3G/4G GSMTAP packets generated by SCAT, Wireshark 2.6.0 or above is required.\nTo properly decode 5G GSMTAPv3 packets generated by SCAT, Wireshark 3.0.0 or above is required, recommended is 4.2.5 or above.\nFor older Wireshark releases, we are providing a Wireshark Lua plugin to extend the GSMTAP dissector.\nThe Wireshark plugin is required to dissect LTE MAC and PDCP packets generated by SCAT version 1.3.0, and NR RRC/NAS-5GS packets.\n\n**Warning:** NR RRC/NAS-5GS messages are only available through GSMTAPv3 which is **[work in progress](https://gitea.osmocom.org/peremen/gsmtapv3)**.\nSCAT master uses GSMTAPv3 draft version only for NR RRC/NAS-5GS, and the definition of GSMTAPv3 may change in the future.\nSCAT does not guarantee data compatibility of GSMTAPv3 packets **until it is finalized**.\nTherefore, please also keep the QMDL/SDM files if you need to preserve 5G signaling messages for future usage.\n\n### Smartphones\n\nCellular device must expost the diagnostic port via USB.\nThis is largely device-dependent and we can not give generic solution for all devices.\nYou can check out following websites for some instructions on either opening up the diagnostic port or collecting the baseband dump file:\n\n* https://band.radio/diag\n* https://cacombos.com/contribute\n\nTry also searching the Internet with keyword `(your device name) qpst` to get the method of exposing the diagnostic port for Qualcomm-based smartphones.\nThe [wiki page](https://github.com/fgsect/scat/wiki/Devices) collects information on tested devices and any device-specific quirks.\n\nIf your smartphone does not expose the diagnostic port via USB, you can try using the baseband dump features existing in some smartphones.\nFollow [the wiki page](https://github.com/fgsect/scat/wiki/Baseband-Dumps) for details.\nWe do not support any companion app on the (rooted) Android device, and there will be no plan to implement this.\n\n## Installation\n\nYou need to explicitly install SCAT before using it.\nJust executing the main script from the git checkout will not work.\nUse any of the following commands:\n\n```\n# If you want fast CRC calculation (for Qualcomm and HiSilicon)\n$ pip install \"signalcat[fastcrc]\"\n\n# If you don't want or can't build libscrc\n$ pip install signalcat\n```\n\nFor development purposes, please use `pip install -e .[fastcrc]` or `pip install -e .` on your checkout directory.\n\nYou will also need to install [udev.rules](https://github.com/M0Rf30/android-udev-rules) on Linux if SCAT is not able to open the USB device as a normal user.\nIf you cannot open a serial device (even as a root), please stop ModemManager.\n\n## Usage\n\nFor smartphones use the USB directly to access the diagnostics port.\nFor discrete cellular modules use the serial mode instead.\nThe `qcserial` and `option` kernel module do not have the information of diagnostic port of all Qualcomm-based smartphones and cellular modules, and no such module exist for Samsung-based smartphones.\n\nBy default, SCAT will send packets to 127.0.0.1, control plane packets to UDP port 4729 as GSMTAP, user plane packets to UDP port 47290 as IP.\n\nExit the application with Ctrl+C.\n\nPlease see the [wiki page for advanced options](https://github.com/fgsect/scat/wiki/Advanced-Options).\n\n### Common Options\n`-t` option specifies the type of baseband. Following options are available:\n\n* `-t qc`: Qualcomm\n* `-t sec`: Samsung\n* `-t hisi`: HiSilicon (experimental, only baseband dump is supported)\n\nSCAT version up to 1.1.0 required specifying the Samsung baseband type manually using `-m`.\nAs SCAT now autodetects the Samsung baseband type, for SCAT 1.2.0 and above this option is only required when analyzing the raw SDM file without start response.\n\n### USB\nAccessing the baseband diagnostics via USB:\n\n```\n$ scat -t qc -u -a 001:010 -i 2\n$ scat -t sec -u -a 001:010 -i 2\n```\n\nAlthough there are small heuristic to determine the connected device, it is recommended to explicitly specify the USB device address and interface number of diagnostics node.\n`-a 001:010` specifies the address, which follows the same syntax visible in `lsusb` command.\n`-i 2` specifies the interface number of the diagnostic node, which is again device specific.\n\nSamsung devices require a correct magic number to be supplied to start the diagnostic session through USB.\nPlease see [Issue #27](https://github.com/fgsect/scat/issues/27#issuecomment-1416233282) for more information on this.\n\n### Serial\nAccessing the baseband diagnostics via serial port:\n\n`$ scat -t qc -s /dev/ttyUSB0`\n\nReplace `/dev/ttyUSB0` to what is your diagnostic device.\n\n### Dump\nParsing the baseband dump file:\n\n```\n$ scat -t qc -d test.qmdl\n$ scat -t sec -d test.sdm\n$ scat -t hisi -d test.lpd\n```\n\n### Tested Devices\n\nPlease see the [wiki page](https://github.com/fgsect/scat/wiki/Devices).\n\n## Known Bugs\n\nIssues related to exposing the diagnostics port via USB is out of scope.\n\n* On certain Qualcomm devices, after exiting and launching the application for\n  more than once, initialization eventually hangs and no messages are appearing.\n  Root cause still in investigation. Solution: reboot the smartphone.\n\n## Chat\n\n* [Matrix](https://matrix.to/#/#scat-users:tchncs.de)\n* [Telegram Bridge](https://t.me/scat_users)\n\nThe canonical address is the Matrix chat room. Telegram is only provided as a bridge and exists only for your convenience. In case of abuse I may close down the Telegram bridge.\n\nRules:\n\n* The `--start-magic` related to the [Issue #27](https://github.com/fgsect/scat/issues/27#issuecomment-1416233282) should not be discussed in the public.\n* Please respect the rules of [tchncs.de](https://tchncs.de/matrix) where the chat room is hosted.\n* Please be nice to each others, and do not push anyone regarding the ETA of any feature of bugfix.\n* SCAT is not a part of KDE project, but I personally recommend [KDE's code of conduct](https://kde.org/code-of-conduct/).\n\n## License\n\nSCAT is free software; you can redistribute it and/or modify it under the terms\nof the GNU General Public License as published by the Free Software Foundation;\neither version 2 of the License, or (at your option) any later version.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\n\n## References\nWe are kindly asking any academic works utilizing and/or incorporating this\nsoftware to cite one of these references listed below:\n\n* Byeongdo Hong, Shinjo Park, Hongil Kim, Dongkwan Kim, Hyunwook Hong, Hyunwoo\n  Choi, Jean-Pierre Seifert, Sung-Ju Lee, Yongdae Kim. **Peeking over the\n  Cellular Walled Gardens - A Method for Closed Network Diagnosis -**. IEEE\n  Transactions on Mobile Computing, February 2018.\n\nThanks to Christian Oschwald and Willem Hengeveld from GSMK for their support\non Samsung SDM parser.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffgsect%2Fscat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffgsect%2Fscat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffgsect%2Fscat/lists"}