I am trying to dump diameter AVP values to CSV format using tshark.When I try -E occurrence=a ,the out put is not proper.I need -a to print all available occurrence.But looks like its printing same o/p multiple times.
Command I am using:
tshark -r 6CCRI.pcap -d tcp.port==1080,diameter -Y diameter.applicationId==4 -T fields -E header=y -E separator=, -E occurrence=a -E quote=d -e frame.number -e diameter.Origin-Host -e diameter.Origin-Realm -e diameter.CC-Request-Type -e diameter.CC-Request-Number
frame.number,diameter.Origin-Host,diameter.Origin-Realm,diameter.CC-Request-Type,diameter.CC-Request-Number
Output:
"1","gy-pdn","starentnetworks.com","1","0" <---------Correct
"2","gy-pdn","starentnetworks.com","1","0"<----------Correct
"3","minid-gy","yahoo.com","1","0"<-----------Correct
"4","gy-pdn,gy-pdn","starentnetworks.com,starentnetworks.com","1,1","0,0"<-------wrong
"5","minid-gy","yahoo.com","1","0"<--------Correct
"6","minid-gy,minid-gy,minid-gy,minid-gy,minid-gy","yahoo.com,yahoo.com,yahoo.com,yahoo.com,yahoo.com","1,1,1,1,1","0,0,0,0,0"<----Wrong
Frame 4/6 also expected as frame 1/2/5.Can you please help to resolve this issue.
asked 19 Nov '14, 05:00
Senapati
1●1●1●2
accept rate: 0%
One quick comment (traveling atm) is that there's a tshark -z option specifically for AVP value extraction that supports multiple occurrences which might serve your purpose.
Same issue observed with tshark -z option.with -z option same frame observed multiple times.Also with this option it is difficult to convert the output to csv file as alignment will not be proper.