First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

diameter protocol CCA and CCR

Hello, I would like to find all CCRs/CCAs in a big diameter trace. Usually I use session-id to correlate them one CCA and one CCR. I filtered all CCAs, how can I find all related CCRs? Is it possible to use something like a FOR loop?

Thanks in advance

MikRusso's avatar
1
MikRusso
asked 2023-01-20 15:09:02 +0000
edit flag offensive 0 remove flag close merge delete

Comments

There is a sample capture attached to 8692: Wireshark combines two diameter messages (RAA & CCR-U) in one

A display filter of diameter.CC-Request-Number seems to show all CCR and CCA.

MATE can be frustrating to work with but was created for stuff like this - WSUG - MATE.

Chuckc's avatar Chuckc (2023-01-20 17:34:05 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

sorry I was not clear in my explanation:

I can find all CCRequests: (diameter.flags.request == 1) && (diameter.cmd.code == 272)

I can find all CCAnswers: (diameter.flags.request == 0) && (diameter.cmd.code == 272)

but to find related CCR/CCA, I need to use a filter on diameter.Session-Id == "bla bla bla" since CCR and related CCA will have the same session id

My issue is find all CCRs and related CCAs

I should use something like for CCR = x to CCR = n , where session id = bla bla bla x find related CCA

is it possible in wireshark?

Thanks in advance, Michele

MikRusso's avatar
1
MikRusso
answered 2023-01-20 17:46:34 +0000
edit flag offensive 0 remove flag delete link
more

Comments

(Assuming CCR is the diameter.CC-Request-Number)
For the sample capture:
diameter.Session-Id == "GatewayService-7-10-0.NeveNG7;1368477994;1073741858" and diameter.CC-Request-Number in {1..3} and (diameter.flags.request == 0) && (diameter.cmd.code == 272)

I'm not a diameter wiz so guessing at the fields.

Chuckc's avatar Chuckc (2023-01-20 18:16:58 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer