This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I want to run a tcpdump capture for all diameter messages (port 3868). But I do not want the Watchdog request/response in the output pcap file. What kind of filter expression can I use ?

Advice appreciated ; rgds

asked 18 Aug '15, 10:05

karhong's gravatar image

karhong
6112
accept rate: 0%


This is the display filter after you finished capturing:

(diameter) && !(diameter.cmd.code == 280)

permanent link

answered 18 Aug '15, 11:07

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%

Hi,

That is the display filter. What I am looking is the filtering out of diameter Watchdog request/responses during the capturing phase. I have taken a look at the manpage of 'pcap-filter'. Those filters have different syntax from the display filters.

Thanks in advance ; rgds.

(18 Aug '15, 11:15) karhong

You can use the above display filter, then export your capture file out using only the displayed packets (File - Export Specified Packets - Under Packet Range just make sure the displayed column is selected and all packets).

You would then have a capture file that only contains the diameter messages, but no watchdog requests and responses. If you are inspecting the capture live, it should only matter what is displayed and then later you are done and want to review it later the exported file would contain only the data you wanted.

(18 Aug '15, 15:54) NiCe85

Capture filters have a much more restricted view of the traffic, they're built for efficiency, and as such they don't understand the diameter protocol.

If the required values are always at the same offset in the capture you can use a capture offset filter using the slicing notation, e.g. tcp[x] = 280, where x is the offset of the diameter.cmd.code field.

(19 Aug '15, 06:11) grahamb ♦

HINT: If you remove single frames from a TCP stream, Wireshark will display error message, because it looks like packet loss, so please ignore error messages like ("TCP ACKed unseen segment" or similar), after you apply my capture filter!!

BTW: There might be better, more elegant capture filters to achieve your goal, but I have no time to optimize anything. It works, so it's good enough for me ;-)

Option #1:

Remove frames that are not Watchdog Request/Answer frames.

dumpcap -ni eth0 -w diameter.pcap -f "port 3868 and not ((tcp[36:4] & 0x80FFFFFF) = 0x00000118 or (tcp[36:4] & 0x80FFFFFF) = 0x80000118)"

However this will also remove (most) ACK frames, as they don't have any data at position tcp[36:4], so you will see TCP error messages in Wireshark if you open the resulting pcap file.

Option #2:

Remove frames that are not Watchdog Request/Answer frames, but also keep ACK frames.

dumpcap -ni eth0 -w diameter.pcap -f "port 3868 and ((ip[2:2]) < 0x40 or not ((tcp[36:4] & 0x80FFFFFF) = 0x00000118 or (tcp[36:4] & 0x80FFFFFF) = 0x80000118))"

However this will also keep the ACK frames for the removed Watchdog frames, so again: error messages in Wireshark about missing frames!

Option #3:

Remove everything without TCP payload and frames that are not Watchdog Request/Answer frames.

dumpcap -ni eth0 -w diameter.pcap -f "port 3868 and ((ip[2:2]) > 0x40 and not ((tcp[36:4] & 0x80FFFFFF) = 0x00000118 or (tcp[36:4] & 0x80FFFFFF) = 0x80000118))"

However this will also remove the ACK frames for the remaining diameter frames, so again: error messages in Wireshark!

Regards
Kurt

permanent link

answered 19 Aug '15, 13:48

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×184
×58

question asked: 18 Aug '15, 10:05

question was seen: 5,335 times

last updated: 19 Aug '15, 13:48

p​o​w​e​r​e​d by O​S​Q​A