This is our old Q&A Site. Please post any new questions and answers at

so I am trying to dissect diameter packets using wireshark library,

when i apply filter 'diameter', and then call dfilter_apply_edt , it always returning false.

what could be the reason behind this.


asked 15 Jan '14, 00:29

Sanny_D's gravatar image

accept rate: 50%

Perhaps the packets are not recognised as Diameter? what's in the frame you are trying to dissect? a full frame starting from ethernet? What happens if you let Wireshark dissect the frame?

(15 Jan '14, 04:05) Anders ♦

actually, i was trying to dissect output of 'ngrep pcap dump', but it does not support packet reassembly, i guess that is why it is not dissecting ?

(15 Jan '14, 04:14) Sanny_D

it depends on the output format of ngrep. What are the options you were using for ngrep?

(15 Jan '14, 06:18) Kurt Knochner ♦

ngrep ".;5233184391;9999" -I /tmp/pcapd/santo.pcap -O sip:incredible_2.pcap -q -t -w 2>&1 >>/dev/null

".;5233184391;9999" is the matching expression. then i am trying to dissect the sip:incredible_2.pcap file, but surprisingly wireshark dissect it fine.

(15 Jan '14, 21:29) Sanny_D

Which protocols do you see in Wireshark?

(16 Jan '14, 01:07) Kurt Knochner ♦

protocols ins frame->eth:ip:sctp:diameter:diameter

(16 Jan '14, 02:00) Sanny_D

well, then something in your code could be wrong. Is it available online?

(16 Jan '14, 02:22) Kurt Knochner ♦

its here,

printf("\nfailed_passed\n");fflush(stdout); executed for some messages.

(16 Jan '14, 21:50) Sanny_D
showing 5 of 8 show 3 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Jan '14, 00:29

question was seen: 1,629 times

last updated: 16 Jan '14, 21:50

p​o​w​e​r​e​d by O​S​Q​A