I am trying to add all Input / Output Octet AVPs to calculate total data used against each Rating-Group. The problem is, not always both Input / Output Octet AVPs will present in each Service-Data-Container AVP. While using tshark command with Tfields or Tjson option, the output looses the original hierarchy, making it impossible to figure out which Octet AVP is associated with which Rating-Group.
Here is the simple snapshot of the Rf ACR packet:
Diameter>
Service-Information>
PS--Information>
Service-Data-Container>
Accounting-Input-Octets=1000
Accounting-Output-Octets=2000
Rating-Group=1111
...
...
Service-Data-Container>
Accounting-Output-Octets=7000
Rating-Group=1111
...
...
Service-Data-Container>
Accounting-Input-Octets=4000
Rating-Group=2222
...
...
Service-Data-Container>
Accounting-Input-Octets=6000
Accounting-Output-Octets=5000
Rating-Group=2222
...
...
In above example, if I add, for Rating-Group=1111, total Accounting-Input-Octets are 1000 and Accounting-Output-Octets are 9000. Similarly, for Rating-Group=2222, total Accounting-Input-Octets are 10000 and Accounting-Output-Octets are 5000.
I run tshark with following options:
tshark -r <file.pcap> -Y <diameter_filter> -Tjson -e diameter.Rating-Group -e diameter.Accounting-Input-Octets -e diameter.Accounting-Output-Octets
[
{
"_index": "packets-2019-08-12",
"_type": "pcap_file",
"_score": null,
"_source": {
"layers": {
"diameter.Rating-Group": [
"1111",
"1111",
"2222",
"2222"
],
"diameter.Accounting-Input-Octets": [
"1000",
"4000",
"6000"
],
"diameter.Accounting-Output-Octets": [
"2000",
"7000",
"5000"
]
}
}
}
]
As you see, its impossible to aggregate the Octets against Rating-Groups.
I am looking for an option where I could get better hierarchy of the packets, something like below:
[
{
"Service-Data-Container":
{
"Accounting-Input-Octets":1000
"Accounting-Output-Octets":2000
"Rating-Group"=1111
}
},
{
"Service-Data-Container":
{
"Accounting-Output-Octets":7000
"Rating-Group"=1111
}
},
{
"Service-Data-Container":
{
"Accounting-Input-Octets":4000
"Rating-Group"=2222
}
},
{
"Service-Data-Container":
{
"Accounting-Input-Octets":6000
"Accounting-Output-Octets":5000
"Rating-Group"=2222
}
}
]
