Multiple occurrences filter for diameter

Question

Hi,

I am trying to use tshark for filtering Diameter messages from a pcap file. I am using following command:

tshark -n -t ad -T fields -E separator=, -E occurrence=a -E aggregator=: -E quote=s -e frame.number -e diameter.Result-Code -e diameter.resp_time -e diameter.hopbyhopid -e diameter.endtoendid -e frame.protocols -r output.txt

One of the output line is

'877','2001:2001',,'0x4e841c7a:0x4e841c80:0x4e841c8f','0xa38a5201:0xa38a5202:0xb13b2c71','eth:vlan:ip:tcp:diameter:diameter:diameter:diameter:diameter'

Now the problem is that this particular TCP packet has three Diameter packets, two with Result code = 2001 and another with Experimental code.

Looking at the above output, I am not able to distinguish which diameter packet has error or successful response.

Could you please help me on this? Is there any way to differentiate and print empty string for not matching condition.

Thanks & Regards Nalin Vilochan

Answer 1

The separator is ',', so the output line's items are:

frame.number: '877'
diameter.Result-Code: '2001:2001'
diameter.resp_time:
diameter.hopbyhopid: '0x4e841c7a:0x4e841c80:0x4e841c8f'
diameter.endtoendid: '0xa38a5201:0xa38a5202:0xb13b2c71'
frame.protocols: 'eth:vlan:ip:tcp:diameter:diameter:diameter:diameter:diameter'

The aggregator is ':', which means that, for the Diameter items, the first item is the value in the first packet, the second item is the value in the second packet, and the third item is the value in the third packet. Unfortunately, from looking at the code, it appears that, if, for example, the middle Diameter packet doesn't have an instance of the field, it doesn't put in a extra aggregator to indicate that the middle value is what's missing, so a value of "2001:2001" could mean that the first two Diameter packets have a result code of 2001, the first and third diameter packets have a value of 2001, or the second and third diameter packets have a result code of 2001.

Answer 2

Internally in Wireshark, there is no relationship between multiple occurrences of one field to multiple occurrences of another field. It is therefor very hard if not impossible to change this, without changing the very nature of the Wireshark dissection engine.

However, you might be able to get what you want using the PDML output format of tshark (-T pdml) and then parse the XML formatted text.

You can also use MATE or LUA to achieve your goals...