Ask Your Question

# Revision history [back]

Your last comment has given the game away. You'll need to supply "Decode As" info to tshark, try something like:

tshark -r test.pcap -d tcp.port==40201,diameter.3gpp -q -V


Adjusting as required for your diameter type (use tshark -d . to see what's supported in your version) and protocol it's running over (might be SCTP). This is presuming that tshark 2.4.5 has the -d parameter.