Wireshark MATE correlation multiple GOPs

I would be happy if a GoG serves my purpose. Pls refer the attached mate config example. I am having issues or confusion on how to compare two attributes

1. Within GoG, how can I compare mport of Megaco PDU and mport of SIP PDU (does it match one to one)

2. When I use this value, for some SIP packets, I get below error in wireshark when I open a capture file Expert Info (Error/Malformed): proto.c:3487: field mate.released_time is not of type FT_FLOAT

   Pdu sip_pdu Proto sip Transport ip {

   Extract user From sip.From;
   Extract user From sip.To;
   Extract user From sip.P-Asserted-Identity;
   Extract user From sip.P-Served-User;
   Extract callid From sip.Call-ID;
   Extract method From sip.Method;
   Extract mport From sdp.media.port;

   };

   Gop sipp On sip_pdu Match (callid) {

   Start(method {"INVITE"|"REGISTER"|"MESSAGE"|"BYE"|"CANCEL"|"PRACK"|"SUBSCRIBE"|"NOTIFY"});
   Stop(never);
   // Store the user in the GOP
   Extra(user,mport);

   };

   Pdu megaco_pdu Proto megaco Transport sctp {

   Extract mgtrans From megaco.transid;
   Extract taction From megaco.transaction;
   Extract mport From sdp.media.port;

   };

   Gop mco On megaco_pdu Match (mgtrans) {

   Start(taction="Request");
   Stop(taction="Reply");
   Extra(mport);

   };

   Gog tester {

   Member sipp(user);
   Member mco (mport);
   
   Extra(user);

   };

   Done;

(FYI I converted your Answer to a Comment–see the FAQ.)

For (1), yes, you’d need to put mport in both the sipp and mco lines to get MATE to include only GoPs whose mport match. I’m not sure what you mean by “one for one”: if the mport is equal then the GoP will be included.

For (2): that’s a bug in Wireshark. I submitted a change to have that fixed.

So, do you think - this should be a valid configuration for my purpose My actual display filter would be - mate.tester.user == xyz to filter all related SIP & H248 packets

Pdu sip_pdu Proto sip Transport ip {

Extract user From sip.From;
Extract user From sip.To;
Extract user From sip.P-Asserted-Identity;
Extract user From sip.P-Served-User;
Extract callid From sip.Call-ID;
Extract method From sip.Method;
Extract mport From sdp.media.port;
};
Gop sipp On sip_pdu Match (callid) {
Start(method {"INVITE"|"REGISTER"|"MESSAGE"|"BYE"|"CANCEL"|"PRACK"|"SUBSCRIBE"|"NOTIFY"});
Stop(never);
// Store the user in the GOP
Extra(user,mport);
};
Pdu megaco_pdu Proto megaco Transport sctp {
Extract mgtrans From megaco.transid;
Extract taction From megaco.transaction;
Extract mport From sdp.media.port;
};
Gop mco On megaco_pdu Match (mgtrans) {
Start(taction="Request");
Stop(taction="Reply");
Extra(mport);
};
Gog tester {
Member sipp(user,mport);
Member mco (mport);
Extra(user);
};
Done;

That looks about right. I’m not sure about the “user” part in this line:

Member sipp(user,mport);

I suspect that might break things but who knows…

Ok, user is needed as I have to filter the trace based on user and not based on media port.

Above works, except the mate.released_time related error I reported before

One last question - I do have some megaco packets before the initial SIP packet, hence I could not get those megaco packets as I could not match the mport. Is it possible to process PDUs/GoPs in reverse direction or after certain PDUs are processed ?