I am analyzing diameter over sctp packets. There are also vendor specific AVPs included which I have added to the diameter dictionary. But then I still get a different result on both computers. The reason are the detected protocols in frame. On one computer (Windows 8) I get the expected result: On the other computer (Windows 7) I get the result: What might be wrong here? If necessary I can add the 4 packets around the problem in pcap-fomat. asked 10 Feb '14, 22:18  efranz |
One Answer:
(As implied by Guy), it sounds a lot like the SCTP preference to reassemble fragmented messages is not enabled on the Windows 7 machine. (It's off by default.) answered 11 Feb '14, 12:02  JeffMorriss ♦ |
So if you read the same capture file with the same version of Wireshark on a Windows 7 machine and a Windows 8 machine, you get different results?
What happens if you make sure that the preference settings for the IP, SCTP and Diameter protocols on the Windows 8 machine are the same as they are on the Windows 7 machine (i.e., look at the settings on the Windows 7 machine, and change the settings on the Windows 8 machine to match them)?
Yes, that is the same capture file and the same version of Wireshark (in both cases the 64-bit version).
Regarding the preference settings for IP, SCTP and Diameter protocol I assume these are the same on both machines, because I did not modify anything afaik. But I will check it in the evening and answer.
(The Windows 8 machine is my private notebook and the Windows 7 machine is the office PC).
Just as an update:
The SCTP preference to reassemble fragmented messages is generally not enabled (independent of Windows 7 or 8).
I enabled reassembling of fragmented messages on my Windows 8 machine and forgot it. Then I recognized the discrepancy.
Maybe it would be a good idea to enable reassembling of fragmented SCTP messages generally (per default). I don't know any reason wher this may harm.
Well, it's probably off because enabling it means using more CPU and lots more memory. But TCP has desegmentation enabled by default so I guess it probably makes sense for SCTP to as well.
I submitted a change to change the default.
BTW, if the Answer on this question, well, answered your question, please Accept it (by clicking the checkmark) so the question won't show up in the list of unanswered questions.