When analyzing a large packet capture of DIAMETER traffic, I often filter based on a certain value. Is there any way to automatically show the replies to the packets matching the display filter? Currently I have to select each packet, and then add the frame number to the display filter. It's very tedious. For example, my display filter will be something like "diameter contains xxxx" where xxxx is actually the IMSI of the user I'm testing with. I then have to click on each packet, and look at the diameter details, and it will say "Reply is in <n>" where "<n>" is the frame number of the response packet. My display filter then becomes "diameter contains xxxx || frame.number == n". asked 15 Mar '13, 13:17  Mojo edited 15 Mar '13, 13:21 |
3 Answers:
This sounds like a job for MATE. Unfortunately the documentation on that can be... Somewhat painful to wade through. answered 19 Mar '13, 08:16  JeffMorriss ♦ |
Does it actually say, "Reply is in < n >"? Because I could only find, Well, assuming that's what you're interested in, you could add 2 custom columns, one for answered 19 Mar '13, 13:52  cmaynard ♦♦ This is useful, but not QUITE what I was looking for. I guess what I want is to write a display filter, and have it show those packets, and ALSO include the packets referenced in each diameter.answer_in field, as sort of joined query (to mix metaphors and use a database term :) ). (19 Mar '13, 14:07) Mojo |
One solution I just discovered on my own is to add the diameter.Session-Id parameter to the display filter. That helps a bunch. answered 15 Mar '13, 14:23 Mojo yes thats correct, first extract message containing IMSI, i.e display filter for IMSI then extract session-id for this message. after getting session-id, apply this as a display filter. either write a simple code, or a unix script will solve the problem. (04 Apr '14, 08:45) Sanny_D |
Very cool, I will check it out. I haven't played with plugins much, but how hard could it be? ;-)
Doesn't look like MATE is being actively maintained. Most of the Wiki pages look like they are at LEAST 5 years old or more.
Yeah, that's what I meant by the documentation being a problem. It does still work--I used it within the past year or so.