Ask Your Question

Only some DIAMETER packets are being dissected as DIAMETER

asked 2021-06-09 03:36:08 +0000

Maria gravatar image

updated 2021-06-09 06:10:54 +0000

Guy Harris gravatar image

My capture has a DIAMETER conversation, but only first pair (request/response) is displayed as DIAMETER , even though all packages are recognized as such in packet comments field. Rest of packets are displayed as TCP. TCP retransmission message is showing. Any idea how to display all in highest protocol? Thank you

edit retag flag offensive close merge delete


Is the "Reassemble Diameter messages spanning multiple TCP segments" preference set? Go to Edit > Preferences on non-Macs or Wireshark > Preferences on Macs, open up "Protocols", and scroll down to "Diameter" (typing "D" might take you to the section for protocols with names beginning with "D"). Is that preference checked?

Also, is the TCP preference "Allow subdissector to reassemble TCP streams" set?

Guy Harris gravatar imageGuy Harris ( 2021-06-09 06:10:20 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2021-06-09 12:49:53 +0000

JeffMorriss gravatar image

By default (IIRC) Wireshark won't dissect TCP retransmissions as the higher-level protocol because doing so may mess up the higher-level protocol's (stateful) dissection.

If you want retransmissions to be dissected, try disabling the TCP dissector's Do not call subdissectors for error packets option.

edit flag offensive delete link more


Thank you guys for your quick response and suggestions, i followed them and try additional options for TCP protocol preferences. Now I can see all packets as diameter disabling "Analyze TCP sequence numbers". I can´t vote or something but I really apreciate your help :-)

Maria gravatar imageMaria ( 2021-06-09 22:59:05 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2021-06-09 03:36:08 +0000

Seen: 71 times

Last updated: Jun 09