ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] H.323 (H.245/H.225) Info-column information

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Sat, 30 Aug 2003 19:07:03 +0200
Hi,

I think that it would be good to have the Info-column information for H.225/H.245 a bit different to be really useful for some of the scenarios I'm using Ethereal (many tunneled H.245 messages). 
I had similar problems when using the H.323-plugin and I recently made some "quick and dirty" changes to the H.323-plugin to get a bit better info in the Info-column for my needs.

Currently (CVS version with both H.245 and H.225 implemented)  when there is e.g. a Q.931/H.225 Facility message with one or several tunneled H.245 messages you'll see only "CS: facility" or "CS: empty" (if h323-message-body is empty) in the Info-column.

It would be good to see what tunneled H.245 messages there is in the message, e.g.
"CS: facility  MasterSlaveDetermination TerminalCapabilitySet,"
or maybe shorter
"CS: facility  MSDet TCS,"

A Setup message with Fast start data could maybe be shown as "CS: setup  OLC" or similar.
A Connect message with Fast start data could maybe be shown as "CS: connect  OLC" or similar.

If there is several TPKT-packets in the same frame then it would be good to have the output something like
"CS: call proceeding, CS: connect,  CS: facility  MSDet  TCS,".

Currently the H.245 dissector shows "Indication", "Response", "Request" ... before the actual H.245 message, but is that really
useful information?  Isn't it the actual H.245 message that is important (OLC, OLCAck, MSDet, MSDetAck... )?

What do you think about my suggestions?

I think that maybe the fence stuff could be useful when implementing something like above.