Use Wireshark to identify diameter messages

Recently, a pcrf system was developed, and the GX interface was used between pcef and pcrf Based on the Diameter protocol. Some problems occurred during the debugging process, I wanted to convert the message into XML format, but it was too troublesome. So I thought of Wireshark and checked whether it could support the Diameter protocol.

First, use tcpdump to capture packets on the server:

Sudo
Tcpdump-S 0-vvv-I lo TCP and host 127.0.0.1 and/(Port 6868 or
Port 5868/)-w gx. Cap

The GX port used by pcrf is 5868, And the 6868 port used by pcef is input to GX. in the CAP file. after the file is stored locally, it is opened with Wireshark. It is found that it can only be parsed to the transport layer protocol and cannot see the diameter format I want.

It is estimated that none of the ports I use are diameter's standard ports, so I cannot identify my packets as diameter messages.

Select a diameter packet, then select analyze from the wireshark menu, and select decode
As, the following dialog box is displayed:

Select the Diameter protocol on the right side and the target port is 6868. In this way, Wireshark can successfully identify the diameter message. It is nice to see AVP directly.