 | 1 | initial version |
I think you need to turn off TCP reassemble when the Diameter message spans multiple TCP segments. In your preference file I believe its enabled by default.
# Whether the Diameter dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
# TRUE or FALSE (case-insensitive)
#diameter.desegment: TRUE
If am correct, you would need -o tcp.desegment_tcp_streams:FALSE in your syntax.