This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Diameter credit control application sessions without termination

0

Hi all,

Could someone suggest a way to display or filter diameter session ID's that have an initial request (CCR-I) but did not get a termination request (CCR-T)?

I think this would be a two step process but just trying to find a way to do it with an expression rather than going session by session.

Thanks a lot!

asked 06 Sep '16, 08:32

kanutomay's gravatar image

kanutomay
11●1●1●2
accept rate: 0%

One Answer:

1

Consider using MATE. It allows to add metafields to packets' dissection trees based on custom-defined relationships between packets. So in your case, MATE would provide a meta-field (like mate.ccr-session.terminated), indicating whether the CCR-T has been captured for a given session ID, to all packets sharing that session ID. This would allow you to display-filter all CCR-I for which no matching CCR-T is present in the capture, using an expression like diameter.CC-Request-Type == 1 and !mate.ccr-session.terminated.

As you've anticipated, it actually is a two step process, but the first step is done by Wireshark as part of packet dissection so you can just use the result.

answered 06 Sep '16, 08:50

sindy's gravatar image

sindy
6.0k●4●8●51
accept rate: 24%

edited 06 Sep '16, 10:49