Add Ericsson Sy selector for sniffing (disect selector for tshark)

[anna.git] / example / diameter / pcapDecoder / tsharkDecoder.sh

diff --git a/example/diameter/pcapDecoder/tsharkDecoder.sh b/example/diameter/pcapDecoder/tsharkDecoder.sh
index 64fd44b..6b14320 100755 (executable)
--- a/example/diameter/pcapDecoder/tsharkDecoder.sh
+++ b/example/diameter/pcapDecoder/tsharkDecoder.sh
@@ -107,7 +107,11 @@ RESULTS_DIR=`dirname $PCAP_FILE`
 # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough):
 FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.length"
 FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment"
-tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
+# Disect selectors
+#   13868 port for Ericsson Sy
+DISECT_SELECTORS="-d tcp.port=13868,diameter"
+
+tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
 # Example output:
 #                                                                               /length\
 # frame     timestamp        src     dst   code R  App-ID   HopByHop   EndToEnd DIAM TCP          protocol                         segments