2

I want to use tshark to filter and process diameter messages. In my capture, I see that I have three diameter messages inside one TCP header. My use case requires me to search for the Result-Code in the diameter message. According to the diameter specification, it is possible to have multiple result codes in a single diameter message. It is also possible to have no result code in a diameter message.

Because of this reason, if I get the result code as A,B,C for three diameter messages, I am unable to recognize which result code belongs to which diameter message.

Is it possible to apply some plugins/features that would help me to split the three diameter messages?

I could see that there is an old chain on a similar topic in https://ask.wireshark.org/questions/4291/multiple-occurrences-filter-for-diameter but there is no answer on how it can be done.

2 Answers 2

0

First of all your assumption regarding the Result-Code is wrong.

According to RFC 6733 (3588 say the same):

7.1. Result-Code AVP

The Result-Code AVP (AVP Code 268) is of type Unsigned32 and
indicates whether a particular request was completed successfully or
an error occurred. All Diameter answer messages in IETF-defined
Diameter application specifications MUST include one Result-Code AVP.

If you will use wireshark you will be able to see each of the answers seperatly and you will be able to see easily which AVP belongs to each answer

5
  • First of all, I need to use tshark for processing the captures and not wireshark. This is because I have to analyze around 10Gb size of file. Nov 10, 2015 at 20:22
  • More over, I agree that the spec mandates that there has to be a result code in each diameter message. It is also possible that a single diameter message contain multiple Result-Codes(One result code at the command level and others inside some grouped AVP). So if one of the diameter message that I am processing contains this pattern, then it would be difficult to map the Result-Code to the diameter session id. Nov 10, 2015 at 20:24
  • If you have 3 answers and 3 result-codes I wouldnt worry about multiple result-codes. Anyway when I want to split a big capture file I take the cap file to windows and use editcap.exe which is installed with wireshark (even though I never tried 10GB). You can find more data about it here: wireshark.org/docs/man-pages/editcap.html Nov 12, 2015 at 4:47
  • @RajeevMenon Do you need a tool that can split a tcp data packet into multiple smaller TCP data packet, each containing a separate response .
    – pktCoder
    Nov 24, 2015 at 22:56
  • Yes. Something similar. By the spec, it is possible to have multiple diameter packets inside the TCP packet. I goal is to retrieve them one by one. Nov 29, 2015 at 4:44
0

I'll second Rajeev on this. When analyzing large amounts of diameter messages, managing merged diameter messages in a single TCP payload becomes intractable.

Example:

tshark -Tfields -e diameter.Session-Id -e diameter.Result-Code -e diameter.CC-Total-Octets -r mydiametercap.pcap -Y "diameter.Result-Code" > session-ids-and-results.txt

This command will sometimes give me this (abstracted) output:

<session-id-1>,<session-id-2>,<session-id-3><tab><many result codes (sometimes 3 per message)><tab><one value of total octets>

I cannot trust that all the fields follow the same convention, and therefore cannot use a reliable parsing algorithm to review the results. It's even worse when you think that the AVPs (that are interpreted in a very flat manner in this diameter implementation) could belong in an MSCC part or in a completely different part, and there is nothing to dissociate those.

Don't get me wrong: tshark rules... :-) Just trying to make it better yet.

2
  • I found a way to work around this issue. It is lengthy but it works! Instead of converting it to text file, tshark provides the flexibility to convert to xml files. I am now using golang to process the xml. Oct 16, 2016 at 2:00
  • And yes, tshark rules :) Oct 16, 2016 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.