Wireshark · Wireshark-users: Re: [Wireshark-users] Display filters for application protocols

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Lukáš Oliva wrote:
>   Hello to the community,
> I am doing some testing for the Diameter protocol and I noticed
> interesting behaviour of the display filters. I noticed that if I run
>
> tshark -r mypcap.pcap -R "diameter.cmd.code==302"
>
> then the output contains afterwards also Diameter packets with
> different diameter.cmd.code. I am not sure if it is actually a bug and
> how tshark handles this filtering for application protocols.
> E.g.: If there is a packet on containing more Diameter (or other
> application protocol) messages on IP (or possibly TCP) level, how is
> this will the display filter filter all of them?
>
> Just for the illustration:
>
> 1  TCP packet: Diameter message 1 (LIR), Diameter message 2 (MAR),
> Diameter message 3 (SAR)
>
> Running tshark -r mypcap.pcap -R "diameter.cmd.code==302" ... # so
> filtering out the LIR messages which have message code 302
>
> Should the tshark produce a list of LIR messages only?

This is normal behavior.  The read/display you have above means:

There exists a field named "diameter.cmd.code" with the value 302 in 
this *frame*.

If the frame passes that filter, it is displayed.

In other words, while Wireshark's TCP dissector is capable of handling 
multiple upper-layer messages in a given frame, the underlying 
architecture is still frame-based.

(You'll see this a lot with SCTP chunk bundling too.)