New Feature: Wireshark Output and Type-1 Dissector

[GhostBassist]

This PR adds a Wireshark Type-1 export path for both downlink and uplink TETRA control/traffic visibility, fixes multiple uplink classification and timing bugs in the main stack, and substantially expands the Lua dissector so captures are actually usable for debugging live signaling.

The work started as “export all Type-1 PDUs to Wireshark”, but during integration it exposed several real stack-side issues in uplink timing, block classification, and traffic/control handling. This PR therefore includes both exporter/dissector improvements and core stack fixes needed to make the exported packets reflect what the radio is actually doing.

Summary

BlueStation can now:

export Type-1 uplink and downlink PDUs to Wireshark with stable metadata
decode much more of the nested LLC, MM, CMCE, and MLE payloads in the Lua dissector
show more useful packet-list summaries such as D-SETUP, D-CALL PROCEEDING, U-SDS-DATA, U-ITSI DETACH, D-NWRK-BROADCAST
suppress very noisy packet classes at the source via config
handle uplink traffic/control burst interpretation more correctly in the main stack
This PR also fixes several regressions/bugs that were causing:

uplink Type-1 frames not to be exported correctly
uplink STCH/FACCH frames to be keyed against the wrong slot
false CRC-fail interpretation in Wireshark
Lua mis-decoding valid uplink SDS/MM/CMCE packets as SNDCP
full-slot uplink NormalTrainSeq2 traffic to break either voice decode or control/FACCH visibility depending on which interpretation was chosen
Main Stack Changes

1. Added Wireshark Type-1 capture export
   BlueStation now emits custom UDP datagrams containing:

direction
logical channel
block number
CRC result
TDMA time
scrambling code
raw Type-1 bits
This gives Wireshark enough information to dissect both control and traffic-adjacent signaling without needing raw RF or Type-5 bits.

Why:

the goal was to inspect decoded MAC/LLC/MM/CMCE traffic externally in Wireshark
BlueStation already had the decoded Type-1 view internally, so exporting that was the most useful integration point
2. Fixed uplink slot/channel state bookkeeping in LMAC/UMAC
Several bugs came from uplink bursts being interpreted using the wrong slot context.

Changes:

uplink channel state is now keyed against the real uplink slot rather than the current downlink slot
blk2_stolen is tracked per uplink timeslot instead of one ambient/global state
UMAC now signals blk2_stolen back to LMAC using the actual uplink burst time, not ambient self.dltime
Why:

PHY reports uplink bursts at dl_time - 2
if control/traffic state is keyed to the wrong slot, LMAC chooses the wrong logical channel and therefore the wrong error-control decode parameters
that showed up as missing uplink signaling, false CRC failures, and missing packets like U-SDS-DATA and U-SETUP
Effect:

uplink STCH/SCH/HU/SCH/F handling is much more consistent
previously missing uplink control PDUs now surface correctly
3. Fixed full-slot uplink NormalTrainSeq2 handling in PHY/LMAC
This was one of the biggest main-stack issues uncovered during Wireshark integration.

Original problem:

full-slot uplink NormalTrainSeq2 bursts were being forced into one interpretation or the other
if treated only as split half-blocks, uplink voice looked bad
if treated only as one full-slot block, uplink FACCH/STCH control and LLC acknowledgements could disappear during active calls
Changes:

PHY now supports full-slot uplink NormalTrainSeq2 more carefully
for full-slot NTS2, the stack now preserves the full-slot Both view for voice decoding
and also restores split Block1 / Block2 visibility for STCH/FACCH/control handling
Why:

active traffic calls need both interpretations:
full-slot TCH/S for voice
split STCH/FACCH for control, stealing, and LLC ack signaling
only supporting one side caused regressions in group-call behavior and Brew-facing call flow
Effect:

uplink voice decode remains available
uplink FACCH/stealing/control traffic on active calls is visible again
fixes the group-call regression where LLC retransmissions exhausted and UL inactivity timeout forced D-TX CEASED
4. Restored compatibility for active group-call/Brew traffic flow
A regression appeared where group calls into Brew broke after the uplink traffic changes.

Observed symptoms:

repeated LLC retransmissions
exhausted retransmission warnings
UL inactivity timeout
forced D-TX CEASED
Brew-side GROUP_IDLE / server error fallout
Root cause:

active-call uplink control on full-slot NTS2 needed both the traffic and split control interpretations
losing the split control view starved FACCH/LLC behavior during active calls
Fix:

restored split NTS2 handling alongside full-slot traffic handling
Effect:

should restore proper uplink control during active traffic calls
Brew failure should disappear as a downstream consequence of fixing the radio/control path
5. Added source-side Wireshark suppression options
New config options in [wireshark]:

suppress_mac_resource
suppress_access_assign
suppress_d_mle_sync
suppress_d_mle_sysinfo
Why:

captures quickly become dominated by high-rate infrastructure/control noise
filtering only in Wireshark is less useful than not exporting that noise in the first place
Effect:

users can keep captures focused on call control, SDS, MM, and other interesting signaling
suppression happens at the emission point, before UDP/PCAP export
Lua Dissector Changes

1. Expanded nested payload decoding
   The Lua dissector now goes much further than basic MAC labeling.

Added/expanded decoding for:

LLC basic link PDUs
downlink MM
uplink MM
downlink CMCE
uplink CMCE
downlink MLE D-NWRK-BROADCAST
improved MAC supplementary handling
better packet-list summaries for nested control payloads
Examples now surfaced in Info/details:

D-SETUP
D-CALL PROCEEDING
D-SDS-DATA
U-SDS-DATA
U-ITSI DETACH
U-LOCATION UPDATE DEMAND / ItsiAttach
group attach/detach related MM PDUs
D-NWRK-BROADCAST
Why:

previously the packet list mostly showed outer wrappers like Downlink SCH/F Both CRC ok
that made it hard to locate call setup, SDS, and MM procedures in live captures
2. Fixed multiple Lua protocol-decoding bugs
Several dissector bugs were found and corrected.

These included:

incorrect interpretation of supplementary MAC vs MAC-U-SIGNAL
wrong LLC header interpretation
wrong MM optional element IDs
stale fragment reuse
redissection instability in Wireshark
fragment overwrite when multiple SCH/HU fragment-starts shared a timeslot
Why:

the Rust stack already had working parsers and served as the reference implementation
the Lua was initially doing heuristic parsing and several bit-boundary assumptions were wrong
Most important fixes:

SCH/HU fragment handling is now much more robust
fragment cache is no longer shared unsafely between summary and detailed decode paths
fragment cache now supports a queue per timeslot rather than one pending fragment, so later fragment-starts do not overwrite earlier ones
Effect:

reassembled uplink SDS/MM/CMCE packets are much more stable
packet-list summary and packet details are far less likely to disagree
valid uplink messages are less likely to collapse into bogus SNDCP
3. Improved traffic labeling
For traffic channels, the Lua no longer treats the traffic CRC field like a generic control-plane CRC verdict.

Why:

for speech traffic, the exported crc_pass reflects the speech Class-2 / bad-frame status, not “MAC/control CRC failed”
Effect:

Wireshark now labels traffic more honestly as Class2 CRC ok / BFI semantics where applicable
reduces confusion when traffic is healthy but the old label implied generic CRC failure
Why These Stack Changes Were Necessary

The Wireshark work exposed that some parts of the stack were correct “functionally enough” for local processing, but not correct enough when every burst had to be exported with stable metadata and later decoded independently.

Specifically:

uplink bursts are time-shifted from the downlink scheduling context
active traffic channels can carry both voice and stealing/control
NormalTrainSeq2 full-slot bursts can need dual interpretation
stale or overly broad state causes wrong logical-channel selection
once exported, Lua cannot recover if the wrapper metadata is already wrong
So this PR does not just add a decoder. It makes the exported Type-1 view faithful to the real radio/control behavior.

[retsplines]

Awesome stuff - works a lot better than the dissector that ships with Wireshark!

Though I think there's a bug in lmac_bs.rs that breaks TCH/S so it never gets passed to the UMAC at the TMD SAP though. Symptom is no voice traffic during calls, and subsequent inactivity timeout for the circuit (last_ul_voice).

I think this is caused by a miscalculation of the ts_idx index into uplink_phy_chan in the rx_tp_prim function. If there's a circuit on slot 2, Self::ul_slot_index(ul_time) calculates the ul_slot_index as 1, when the uplink slot index is actually 3.

Changing Self::ul_slot_index(ul_time) to a call to Self::ul_slot_index_for_dl_time(message.dltime) seems to resolve this. Otherwise all looks good!