Hello Guys, I am trying to extract 3GPP_User_Location_Info from Radius messages. However in this instance it is not extracting info correctly $ tshark -v TShark 1.10.2 (SVN Rev 51934 from /trunk-1.10) tshark -T fields -e radius.Calling_Station_Id -e radius.3GPP_User_Location_Info -e radius.3GPP_IMEISV -e radius.Framed-IP-Address -E header=y -E separator=, -E quote=d -r Nikola_TEST_cap.pcap | head radius.Calling_Station_Id,radius.3GPP_User_Location_Info,radius.3GPP_IMEISV,radius.Framed-IP-Address "6149891xxxx",,"3598220413753808","144.131.70.63" "6145563xxxx",,"3598220423540908","101.175.33.128" For some reason the 3GPP-User-Location-Id AVP doesn’t get extracted by tshark, although Wireshark shows/decodes the AVP just file. I upgraded my copy of Wireshark on the Mac to the latest but still seeing the same issue. The AVP is listed in the dictionary and in tshark –G fields so suspect it may be a bug? Other 3GPP fields are extracted ok. asked 21 Oct '13, 15:34  Nik_NSW_2150 edited 21 Oct '13, 17:03  Kurt Knochner ♦ |
One Answer:
Hello Kurt,
we are running a later version 1.10.2 and the 3GPP-User-Location-Info field is not displaying at all in tshark
Works with 0.99.7 Windows version and TShark 0.99.7 Somewhere between the version 1.10.2 and 0.99.7 there is a bug.
Please update Bug 7474.
Maybe I was not clear . What I am trying to say is that below works for
TShark 0.99.7 but not for 1.10.2 version
% tshark -T fields -e radius.Calling_Station_Id -e radius.3GPP_User_Location_Info -E header=y -E separator=, -E quote=d -r TEST_cap.pcap | head radius.Calling_Station_Id,radius.3GPP_User_Location_Info "61498913","01:05:f5:10:55:50:16:5a" "6145563","01:05:f5:10:13:50:2e:4d" "614193","01:05:f5:10:10:50:00:eb"