Ask Your Question

Diameter packet shows as tcp

asked 2019-05-20 20:46:02 +0000

SSel gravatar image

Hello. I have tshart performing packet captures. I have seen it where it discards diameter packets because it thinks it is a TCP packet. Same packet when opened In wireshark looks correct. Are there any tshark settings that need to be tweaked?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-05-21 16:17:52 +0000

Grrrshark gravatar image

I think you need to turn off TCP reassemble when the Diameter message spans multiple TCP segments. In your preference file I believe its enabled by default.

# Whether the Diameter dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
# TRUE or FALSE (case-insensitive)
#diameter.desegment: TRUE

If am correct, you would need -o tcp.desegment_tcp_streams:FALSE in your syntax.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-05-20 20:46:02 +0000

Seen: 654 times

Last updated: May 21 '19