sample wireshark captures from wireshark site

For the control plane traffic on the S1-MME interface (between the eNB and Mobility Management Entity (MME)), you need access to the service provider's internal network. To capture from the MAC layer and higher (Ethernet layer to IP/UDP/GTP-U/IP layers) then you would need access to the S1-U interface (between the eNB and Serving Gateway (S-GW)) for the user plane traffic. The LTE modem is just the connection between the transceiver of the UE and the transceiver of the eNodeB or gNodeB (RRH or RU). This is why you are not seeing the layer 2 protocol stack components (MAC, RLC, PDCP, RRC) for the radio communications between the UE and the eNodeB (base station controller or BBU). You will need to make a direct USB connection to the mobile device from a PC or laptop and use the suite of Qualcomm tools If you are using a LTE modem, this will only be at the OSI lower layer 1 & any sublayers, primarily the physical layer (PHY). To capture LTE packets from a UE (mobile cell phone), you can use the Qualcomm tools like the previous person mentioned. Hi I know this is an old post from roughly three (3) years ago but I thought I should weigh in anyhow.

Sample wireshark captures from wireshark site