Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

I think you need to turn off TCP reassemble when the Diameter message spans multiple TCP segments. In your preference file I believe its enabled by default.

# Whether the Diameter dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
# TRUE or FALSE (case-insensitive)
#diameter.desegment: TRUE

If am correct, you would need -o tcp.desegment_tcp_streams:FALSE in your syntax.