Is it possible to change the decoding priority when ports conflict?

asked 2025-12-25 10:25:49 +0000

When parsing 4G and 5G packets, lots of 5G http2 messages will be sent from NF consumer. Normally such NF consumer will have a port scale as client, not only for http2 in 5G but also for like diameter in 4G.

For example, NF consumer client port scale is 60001~61000. As majority of such messages in 5G are http2, so we configured protocol http2 in Wireshark with port scale 60001~65535 for tcp, diameter port scale is 3867~3869 for tcp. When a packet source port is 60001, destination port is 3868, this shall be a diameter message. But wireshark will decode it as http2(though it will be displayed as tcp packet) other than diameter. So every time when we need analyze diameter packets we have to remove the configured tcp port scale from http2; while in analyzing http2 packets we need add them back.

Is it possible to make the diameter decoding prioritized over http2, so that when a packet matches port scale of both http2 and diameter, it will be decoded as diameter message. Or make it configurable on which is prioritized, diameter or http2.

Thanks!

edit retag flag offensive close merge delete