This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

unable to add semi-colon to filter for tshark

0

Hello,

I also have some troubles to use diameter.Session-Id filters. For my part the semi-colon is not allowed by tshark in the command line.

-R diameter.Subsession-Id=="65847;53642;517-02" returns : tshark: ";" was unexpected in this context.

REGEXs, contains, matches, don't seem to be allowed as well ...

Any idea to filter this AVP value ??

Thx

asked 19 Nov '13, 03:31

AIex's gravatar image

AIex
11●1●1●2
accept rate: 0%

converted to question 19 Nov '13, 03:45

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

One Answer:

1

On Windows, if I use proper quoting, I get:

tshark -Y "diameter.Subsession-Id==\"65847;53642;517-02\""
tshark: "65847;53642;517-02" cannot be converted to Unsigned integer, 4 bytes.

From the diameter display filter reference page:

diameter.Subsession-Id  Subsession-Id   Unsigned integer, 4 bytes   1.8.0 to 1.10.3

This means that the ';' character is invalid for this field.

answered 19 Nov '13, 07:01

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

My mistake, I didn't paste the right AVP, I actually tried to filter the "diameter.Session-Id". Unfortunately the matter is still the same for this "Character string" AVP.

diameter.Session-Id Session-Id Character string 1.0.0 to 1.2.0, 1.2.2 to 1.10.3

-R diameter.Session-Id=="65847;53642;517-02" tshark: ";" was unexpected in this context.

(19 Nov '13, 07:11) AIex
1

Try using proper quoting:

  • Windows: tshark.exe -Y "diameter.Session-Id==\"65847;53642;517-02\""
  • *Nix: tshark -Y 'diameter.Session-Id=="65847;53642;517-02"'
(19 Nov '13, 07:26) cmaynard ♦♦

It works with this quoting format

'diameter.Session-Id=="65847;53642;517-02"'

Thanks a lot !!!

(19 Nov '13, 07:47) AIex