Ask Your Question

Diameter 'Answer In'/'Request In' fields not available with tshark/pyshark

asked 2019-05-16 15:28:37 +0000

Bence gravatar image

Hi All,

I am using pyshark (a Python wrapper for tshark) to analyse traffic capture files, and I ran into a problem around finding Diameter Common Messages request/answer pairs.

The Wireshark GUI helps identifying the answer to a specific Diameter request packet with the field called Answer In. The Request In field helps the other way around. See the Wireshark Diameter Protocol Display Filter Reference, diameter.answer_in and diameter.answer_to field names.

Using the above information makes it easy to construct display filters in the Wireshark GUI for selecting specific request/answer pairs. Unfortunately, when using the tshark CLI on the same capture file, this field seems to be missing.

tshark -r d:/test.pcapng -Y diameter.answer_in  # Works in Wireshark GUI, not in tshark

What do I need to use these field names for filtering capture files with tshark?

My tshark version is: TShark (Wireshark) 2.9.0 (v2.9.0-0-gf4238cd2)

Many thanks, Bence

edit retag flag offensive close merge delete


2.9 is a development version, you should upgrade to the stable release 3.0 if you can.

grahamb gravatar imagegrahamb ( 2019-05-16 16:01:24 +0000 )edit

I did have the 3.0 version, but had to downgrade because it broke something with pyshark. Can't recall what it was exactly, maybe it is fixed now in pyshark, will give it another try later. Thanks

Bence gravatar imageBence ( 2019-05-16 22:18:51 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-05-16 16:00:35 +0000

grahamb gravatar image

Some fields, and particularly the answer_in field here requires a 2nd pass over the capture as the "answer" packet hasn't been dissected when the request is being dissected.

Try adding the -2 flag to tshark.

edit flag offensive delete link more


That did it, appreciate the help. Cheers

Bence gravatar imageBence ( 2019-05-16 22:17:19 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-05-16 15:28:37 +0000

Seen: 641 times

Last updated: May 16 '19