MATE: co-relate radius.User_Name and diameter.User-Name messages & extract sessions

Hi Jeff,

Thanks for suggestion. I have managed to solve issue partially.

Following MATE code give me complete life-cycle of the user with few caveat i.e.

1. radius request (except CoA) & diameter messages are using IPv6 transport. However Radius CoA message is using IPv4 transport. I am unable to co-relate "radius + coa + diameter" in single MATE filter. Except that all the messages are extracted properly
2. I have to go over each and every diameter message which has 5002 Result-Code. Is there any way to get complete list of such messages (having 5002 Result-Code) instead of going over it again and again ? Do I have to use external bash script approach i.e. for loop -> grep -> sort -u ..etc. ?

Apologies, I couldn't format below message properly hence marked as answer. But voted your earlier message as Solution :-)

Code :

Pdu radius_pdu Proto radius Transport ipv6 {
Extract addr From ipv6.addr ;
Extract port From udp.port ;
Extract radius_id From radius.id ;
Extract username From radius.User_Name ;
Extract radius_code From radius.code ;
};
// Identifying PDU start / stop is critical
Gop radius_req On radius_pdu Match (addr, addr, port, port, radius_id ) {
Start (radius_code {1|4} );
Stop (radius_code {2|3|5} );
Extra (username); // This is the common key to link radius & diameter messages
};
Pdu radius_coa_pdu Proto radius Transport udp/ip {
Extract addr From ip.addr ;
Extract port From udp.port ;
Extract radius_id From radius.id ;
Extract username From radius.User_Name ;
Extract radius_code From radius.code ;
};
Gop coa_tx On radius_coa_pdu Match (addr, addr, port, port, radius_id ) {
Start (radius_code {40|43} );
Stop (radius_code {41|42|44|45} );
Extra (username);
};
Pdu diameter_pdu Proto diameter Transport ip {
Extract command_code From diameter.cmd.code;
Extract app_id From diameter.applicationId;
Extract session_id From diameter.Session-Id;
Extract username From diameter.User-Name;
Extract e2eid From diameter.endtoendid;
Extract diameter_code From diameter.Result-Code ;
};
Gop dia_tx On diameter_pdu Match (command_code, app_id, session_id, e2eid) {
Start();
Stop(never);
Extra (username, diameter_code);
};
// it is critical that both the members on Gog share exactly same key name i.e. username in this case.
// I tried setting one as radius_username & other as diameter_username but I could not filter PDUs with username as key
Gog radius_dia_results {
Member dia_tx(username);
Member radius_req(username);
Extra (username, diameter_code); // Extract username field to include in MATE PDU tree
};
Gog coa_dia_results {
Member dia_tx(username); // username is the common key to link radius & diameter messages
Member coa_tx(username); // username is the common key to link radius & diameter messages
Extra (username, diameter_code); // Extract username & diameter_code field to include in MATE PDU tree
};
Done;

Glad you’re making progress. :-) I converted my comment to an answer your your answer to a comment (more or less as you suggested).

A note on formatting: yes, I frequently compose my comments in the answer window and then cut-n-paste it into the comment window. It makes the formatting easier…

1. Two possibilities: a) can you simply change the Radius Transport to udp rather than ip and ipv6? I thought that would work. b) If that doesn’t do it can’t you add coa_tx(username) to radius_dia_results? A GOG isn’t limited to just 2 members and it doesn’t (shouldn’t) care if the transports are different.
2. I assume you’re saying that you need to need to look at every message of every group of Radius and Diameter transactions that got a Diameter Result-Code of 5002, presumably one username at a time (i.e., username “12345” got a 5002 so now you need to go look at all the messages for that user leading up to that error)? Yes, I think you’re going to have to do that in 2 passes: one to get the list of usernames that got a 5002 and then a second pass to look at the messages for each problematic username. A bash/tshark script would be good for the first pass; how you do the second pass depends on how you want to look at the results. Personally I’d probably do a 2nd pass with tshark generating lots of PCAP files (one per problematic username) so I could view/browser the results in Wireshark.