I am trying to decode raw frames of a diameter call using tshark, all the fields: Command code, Application Id, AVPs are labelled as 'Unknown'. This labelling is followed by a sentence 'if you know what this is you can add it to dictionay.xml'. Am I missing some options? How to resolve this issue?
It means that Wireshark hasn't the information available to translate these numbers into something meaningful.
If you have this in an XML file, you could add them to the dictionary.xml, as stated, to aid in their dissection.
If you don't have them you may want to try the development version of Wireshark (3.5.0) to see if these are included in the mean time.
Not sure what you mean by 'raw frames', but maybe you could explain that in a comment.
Thank you Jaap Keuter, the values of Application Id, AVPs are present in the Dictionay.xml. For a yum installation of wireshark, this issue is not seen. While building it locally this occurs. Any idea why this might be happening?
For some reason the locally built Wireshark isn't able to find the dictionary. You can look in the About dialog, in the Folders tab, to see where it looks for it.
Could you please clarify, which About dialog and Folders tab are you referring to?
Comments