dear team, in addition to above query, could you please help me to filter diameter messages in TSHARK using Session id.. i am able to display capyured diameter send & received messages in wireshark, i want to do the same in TSHARK in my script, but getting error as "tshark: ";" was unexpected in this context." tshark.exe -r dia.pcap -V "diameter.Session-Id == "MMEC78.MMEGI8024.MME.EPC.MNC007.MCC404.3GPPNETWORK.ORG;3332250302;92145410;mme"" error: tshark: ";" was unexpected in this context. please suggest. asked 26 Jan '17, 11:31  sudheer628 converted to question 26 Jan '17, 11:36  JeffMorriss ♦ |
One Answer:
You have to escape the inner double quotes: answered 26 Jan '17, 12:20  Uli Thanks Uli.. it works.. could you help related query.. i want to filter diamter user name, it works in wireshark but i get nothing in tshark (not even a error), reason is that tshark is not reading AVP: user-name message, which contains my IMSI (its LTE Mobile trace). tshark filter used: tshark.exe -r dia.pcap -V "diameter.User-Name == "404071610557333"" kindly help.. (26 Jan '17, 12:47) sudheer628 Looks like the same reason: escape the inner quotes? tshark.exe -r dia.pcap -V "diameter.User-Name == \"404071610557333\"" (26 Jan '17, 13:32) Uli Not sure if your issue was resolved. I want to add here that tshark.exe -r dia.pcap -R "diameter.User-Name == 404071610557333" -O diameter command shall provide you desired results. Besides I you to use latest wireshark app as and when you can. (13 Mar '17, 10:04) Vijay Gharge |
I converted your Answer to this question to a new question. This is a Q&A site, not a forum--please see the FAQ.