Ethereal-dev: Re: [Ethereal-dev] Problems with H.323 dissector(s)
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Mon, 1 Sep 2003 06:15:19 +0200
Andres Sikkema wrote:
>There is another error in the IRR/PerCallInfo stuff. The H.245
>TransportAddress has a problem deciding what kind of address it is. I
>haven't been able to find out why, the ASN.1 and the dissector seem to
>agree about optionality and stuff.
>
>See attached capture file containing one frame with the problem.
The problem seems to be with the H.225 NonStandardParameter. The definition of NonStandardParameter in H.225 is not the same
as in H.245. The NonStandardParameter in H.225 has an extensionmarker in NonStandardIdentifier and in H221NonStandard.
Ronnie made a fix a week ago, but it seems that it was not completely correct even if it solved the problem for all the captures I tried with.
When I made some changes as described below I got your sample capture to be decoded correctly (I think) and it seems that my other captures are still working (I have only tried some of them yet). I have attached the results I got after my modifications and what results
the H.323-plugin gave for the same capture.
NonStandardParameter ::= SEQUENCE
{
nonStandardIdentifier NonStandardIdentifier,
data OCTET STRING
}
NonStandardIdentifier ::= CHOICE
{
object OBJECT IDENTIFIER,
h221NonStandard H221NonStandard,
...
}
H221NonStandard ::= SEQUENCE
{ t35CountryCode INTEGER(0..255),
t35Extension INTEGER(0..255),
manufacturerCode INTEGER(0..65535),
...
}
I think that the table for NonStandardParameter_with_extension_sequence (NonStandardParameter for H.221) should be:
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
static per_sequence_t NonStandardParameter_with_extension_sequence[] = {
{ "nonStandardIdentifier", NO_EXTENSIONS, NOT_OPTIONAL,
dissect_h245_NonStandardIdentifier_with_extension },
{ "data", NO_EXTENSIONS, NOT_OPTIONAL,
dissect_h245_NonStandardParameterData },
{ NULL, 0, 0, NULL }
};
and then there needs to be a specific implementation of NonStandardIdentifier and H221NonStandard to be used for H.221, e.g. :
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
static per_sequence_t h221NonStandard_with_extension_sequence[] = {
{ "t35CountryCode", EXTENSION_ROOT, NOT_OPTIONAL,
dissect_h245_t35CountryCode },
{ "t35Extension", EXTENSION_ROOT, NOT_OPTIONAL,
dissect_h245_t35Extension },
{ "manufacturerCode", EXTENSION_ROOT, NOT_OPTIONAL,
dissect_h245_manufacturerCode },
{ NULL, 0, 0, NULL }
};
int
dissect_h245_h221NonStandard_with_extension(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree)
{
t35CountryCode = 0;
t35Extension = 0;
manufacturerCode = 0;
offset=dissect_per_sequence(tvb, offset, pinfo, tree, hf_h245_h221NonStandard, ett_h245_h221NonStandard, h221NonStandard_with_extension_sequence);
h221NonStandard = ((t35CountryCode * 256) + t35Extension) * 65536 + manufacturerCode;
return offset;
}
static per_choice_t NonStandardIdentifier_with_extension_choice[] = {
{ 0, "object", EXTENSION_ROOT,
dissect_h245_object },
{ 1, "h221NonStandard", EXTENSION_ROOT,
dissect_h245_h221NonStandard_with_extension },
{ 0, NULL, 0, NULL }
};
static int
dissect_h245_NonStandardIdentifier_with_extension(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree)
{
guint32 value;
*object = '\0';
h221NonStandard = 0;
offset=dissect_per_choice(tvb, offset, pinfo, tree, hf_h245_NonStandardIdentifier, ett_h245_NonStandardIdentifier, NonStandardIdentifier_with_extension_choice, "NonStandardIdentifier with extension", &value);
switch (value) {
case 0 : /* object */
nsp_handle = dissector_get_port_handle(nsp_object_dissector_table, adler32_str(object));
break;
case 1 : /* h221NonStandard */
nsp_handle = dissector_get_port_handle(nsp_h221_dissector_table, h221NonStandard);
break;
default :
nsp_handle = NULL;
}
return offset;
}
The NonStandard definitions in the H.245 specifications doesn't have any extension markers:
--------------------------------------------------------------------------------------------------------------------------------
NonStandardParameter ::=SEQUENCE
{
nonStandardIdentifier NonStandardIdentifier,
data OCTET STRING
}
NonStandardIdentifier ::=CHOICE
{
object OBJECT IDENTIFIER,
h221NonStandard SEQUENCE
{
t35CountryCode INTEGER (0..255), -- country, per T.35 Annex A
t35Extension INTEGER (0..255),
-- assigned nationally unless t35CountryCode is binary
-- 1111 1111, in which case it shall contain the country code
-- according to T.35 Annex B
manufacturerCode INTEGER (0..65535) -- assigned nationally
}
}
Frame 1 (197 bytes on wire, 197 bytes captured)
Arrival Time: Dec 9, 2002 18:48:28.925013000
Time delta from previous packet: 0.000000000 seconds
Time relative to first packet: 0.000000000 seconds
Frame Number: 1
Packet Length: 197 bytes
Capture Length: 197 bytes
File Offset: 40 (0x28)
Ethernet II, Src: 00:02:b9:fa:41:79, Dst: 00:80:c8:ca:fd:c4
Destination: 00:80:c8:ca:fd:c4 (D-Link_ca:fd:c4)
Source: 00:02:b9:fa:41:79 (Cisco_fa:41:79)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.102.1.33 (10.102.1.33), Dst Addr: 10.102.1.33 (10.101.1.240)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 183
Identification: 0x0019 (25)
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (0x11)
Header checksum: 0xa341 (correct)
Source: 10.102.1.33 (10.102.1.33)
Destination: 10.102.1.33 (10.102.1.33)
User Datagram Protocol, Src Port: 56733 (56733), Dst Port: 1719 (1719)
Source port: 56733 (56733)
Destination port: 1719 (1719)
Length: 163
Checksum: 0x3a6a (correct)
H.225.0 RAS
RasMessage
RasMessage: .101 10.. : infoRequestResponse (22)
InfoRequestResponse
RequestSeqNum: 26
EndPointType
GatewayInfo
protocol
Item 0
SupportedProtocols
SupportedProtocols: .011 1... : voice (7)
VoiceCaps
SupportedPrefixes
Item 0
SupportedPrefix
prefix
prefix: ...0 .... : dialedDigits (0)
privateNumberDigits: 9
mc: 0... .... False
undefinedNode: .0.. .... False
EndpointIdentifier: 615743C40000008C
rasAddress
rasAddress: .000 .... : ipAddress (0)
ipAddress
IP: 10.102.1.33 (10.102.1.33)
Port: 56733
callSignalAddress
Item 0
TransportAddress
TransportAddress: .000 .... : ipAddress (0)
ipAddress
IP: 10.102.1.33 (10.102.1.33)
Port: 1720
endpointAlias
Item 0
AliasAddress
AliasAddress: .1.. .... : h323ID (1)
h323ID: Cisco_GW_UK_WAN
perCallInfo
Item 0
perCallInfo_item
NonStandardParameter
NonStandardIdentifier with extension
NonStandardIdentifier type: .... ...1 : h221NonStandard (1)
h221NonStandard
t35CountryCode: United States (181)
t35Extension: 0
manufacturerCode: 18
Octet String Length: 5
data: 70388A5247
CallReferenceValue: 7
conferenceID: 33F68493D06711D380109EE14B943CDA
h245
callSignaling
CallType
CallType: .... ...0 0... .... : pointToPoint (0)
BandWidth: 1280
CallModel
CallModel: .0.. .... : direct (0)
CallIdentifier
guid: 33F68493D06711D380119EE14B943CDA
needResponse: 0... .... False
Frame 1 (197 bytes on wire, 197 bytes captured)
Arrival Time: Dec 9, 2002 18:48:28.925013000
Time delta from previous packet: 0.000000000 seconds
Time relative to first packet: 0.000000000 seconds
Frame Number: 1
Packet Length: 197 bytes
Capture Length: 197 bytes
File Offset: 40 (0x28)
Ethernet II, Src: 00:02:b9:fa:41:79, Dst: 00:80:c8:ca:fd:c4
Destination: 00:80:c8:ca:fd:c4 (D-Link_ca:fd:c4)
Source: 00:02:b9:fa:41:79 (Cisco_fa:41:79)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.102.1.33 (10.102.1.33), Dst Addr: 10.101.1.240 (10.101.1.240)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 183
Identification: 0x0019
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (0x11)
Header checksum: 0xa341 (correct)
Source: 10.102.1.33 (10.102.1.33)
Destination: 10.101.1.240 (10.101.1.240)
User Datagram Protocol, Src Port: 56733 (56733), Dst Port: 1719 (1719)
Source port: 56733 (56733)
Destination port: 1719 (1719)
Length: 163
Checksum: 0x3a6a (correct)
ITU-T Recommendation H.225.0
infoRequestResponse
requestSeqNum: 26
endpointType (EndpointType)
gateway (GatewayInfo)
protocol (SupportedProtocols)
Item 0 (voice)
voice
supportedPrefixes (SupportedPrefix)
Item 0 (SupportedPrefix)
prefix (e164)
e164: 9
mc: False
undefinedNode: False
endpointIdentifier: 615743C40000008C
rasAddress (ipAddress)
ipAddress
ip: 10.102.1.33 (10.102.1.33)
port: 56733
callSignalAddress (TransportAddress)
Item 0 (ipAddress)
ipAddress
ip: 10.102.1.33 (10.102.1.33)
port: 1720
endpointAlias (AliasAddress)
Item 0 (h323_ID)
h323_ID: Cisco_GW_UK_WAN
perCallInfo (InfoRequestResponse-perCallInfo)
Item 0 (InfoRequestResponse-perCallInfo-subtype)
nonStandardData (NonStandardParameter)
nonStandardIdentifier (h221NonStandard)
h221NonStandard
t35CountryCode: 181
t35Extension: 0
manufacturerCode: 18
data: p8RG
callReferenceValue: 7
conferenceID: 33F68493-D067-11D3-8010-9EE14B943CDA
h245 (TransportChannelInfo)
callSignaling (TransportChannelInfo)
callType (pointToPoint)
pointToPoint: pointToPoint
bandWidth: 1280
callModel (direct)
direct: direct
callIdentifier (CallIdentifier)
guid: 33F68493-D067-11D3-8011-9EE14B943CDA
needResponse: False
Frame 1 (197 bytes on wire, 197 bytes captured)
Arrival Time: Dec 9, 2002 18:48:28.925013000
Time delta from previous packet: 0.000000000 seconds
Time relative to first packet: 0.000000000 seconds
Frame Number: 1
Packet Length: 197 bytes
Capture Length: 197 bytes
File Offset: 40 (0x28)
Ethernet II, Src: 00:02:b9:fa:41:79, Dst: 00:80:c8:ca:fd:c4
Destination: 00:80:c8:ca:fd:c4 (D-Link_ca:fd:c4)
Source: 00:02:b9:fa:41:79 (Cisco_fa:41:79)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.102.1.33 (10.102.1.33), Dst Addr: 10.102.1.33 (10.101.1.240)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 183
Identification: 0x0019 (25)
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (0x11)
Header checksum: 0xa341 (correct)
Source: 10.102.1.33 (10.102.1.33)
Destination: 10.102.1.33 (10.102.1.33)
User Datagram Protocol, Src Port: 56733 (56733), Dst Port: 1719 (1719)
Source port: 56733 (56733)
Destination port: 1719 (1719)
Length: 163
Checksum: 0x3a6a (correct)
H.225.0 RAS
RasMessage
Extension Bit: 0... .... False
RasMessage: .101 10.. : infoRequestResponse (22)
InfoRequestResponse
Extension Bit: .... ..1. True
Optional Field Bit: .... ...0 False (nonStandardData is NOT present)
Optional Field Bit: 1... .... True (endpointAlias is present)
Optional Field Bit: .1.. .... True (perCallInfo is present)
RequestSeqNum: 26
EndPointType
Extension Bit: 0... .... False
Optional Field Bit: .0.. .... False (nonStandardData is NOT present)
Optional Field Bit: ..0. .... False (vendor is NOT present)
Optional Field Bit: ...0 .... False (gatekeeper is NOT present)
Optional Field Bit: .... 1... True (gateway is present)
Optional Field Bit: .... .0.. False (mcu is NOT present)
Optional Field Bit: .... ..0. False (terminal is NOT present)
GatewayInfo
Extension Bit: .... ...0 False
Optional Field Bit: 1... .... True (protocol is present)
Optional Field Bit: .0.. .... False (nonStandardData is NOT present)
protocol
Sequence-Of Length: 1
Item 0
SupportedProtocols
Extension Bit: 0... .... False
SupportedProtocols: .011 1... : voice (7)
VoiceCaps
Extension Bit: .... .1.. True
Optional Field Bit: .... ..0. False (nonStandardData is NOT present)
Small Number Bit: .... ...0 False
Number of Sequence Extensions: 1
Extension Present Bit: .... ..0. False (dataRatesSupported is NOT present)
Extension Present Bit: .... ...1 True (supportedPrefixes is present)
Open Type Length: 4
SupportedPrefixes
Sequence-Of Length: 1
Item 0
SupportedPrefix
Extension Bit: 0... .... False
Optional Field Bit: .0.. .... False (nonStandardData is NOT present)
prefix
Extension Bit: ..0. .... False
prefix: ...0 .... : dialedDigits (0)
Octet String Length: 1
privateNumberDigits: 9
mc: 0... .... False
undefinedNode: .0.. .... False
Octet String Length: 16
EndpointIdentifier: 615743C40000008C
rasAddress
Extension Bit: 0... .... False
rasAddress: .000 .... : ipAddress (0)
ipAddress
IP: 10.102.1.33 (10.102.1.33)
Port: 56733
callSignalAddress
Sequence-Of Length: 1
Item 0
TransportAddress
Extension Bit: 0... .... False
TransportAddress: .000 .... : ipAddress (0)
ipAddress
IP: 10.102.1.33 (10.102.1.33)
Port: 1720
endpointAlias
Sequence-Of Length: 1
Item 0
AliasAddress
Extension Bit: 0... .... False
AliasAddress: .1.. .... : h323ID (1)
Octet String Length: 15
h323ID: Cisco_GW_UK_WAN
perCallInfo
Sequence-Of Length: 1
Item 0
perCallInfo_item
Extension Bit: 1... .... True
Optional Field Bit: .1.. .... True (nonStandardData is present)
Optional Field Bit: ..0. .... False (originator is NOT present)
Optional Field Bit: ...0 .... False (audio is NOT present)
Optional Field Bit: .... 0... False (video is NOT present)
Optional Field Bit: .... .0.. False (data is NOT present)
NonStandardParameter
NonStandardIdentifier with extension
Extension Bit: .... ..0. False
NonStandardIdentifier type: .... ...1 : h221NonStandard (1)
h221NonStandard
Extension Bit: 0... .... False
t35CountryCode: United States (181)
t35Extension: 0
manufacturerCode: 18
Octet String Length: 5
data: 70388A5247
CallReferenceValue: 7
conferenceID: 33F68493D06711D380109EE14B943CDA
h245
Extension Bit: 0... .... False
Optional Field Bit: .0.. .... False (sendAddress is NOT present)
Optional Field Bit: ..0. .... False (recvAddress is NOT present)
callSignaling
Extension Bit: ...0 .... False
Optional Field Bit: .... 0... False (sendAddress is NOT present)
Optional Field Bit: .... .0.. False (recvAddress is NOT present)
CallType
Extension Bit: .... ..0. False
CallType: .... ...0 0... .... : pointToPoint (0)
BandWidth: 1280
CallModel
Extension Bit: 0... .... False
CallModel: .0.. .... : direct (0)
Small Number Bit: ..0. .... False
Number of Sequence Extensions: 5
Extension Present Bit: .1.. .... True (callIdentifier is present)
Extension Present Bit: ..0. .... False (tokens is NOT present)
Extension Present Bit: ...0 .... False (cryptoTokens is NOT present)
Extension Present Bit: .... 0... False (substituteConfIDs is NOT present)
Extension Present Bit: .... .0.. False (pdu is NOT present)
Extension Present Bit: .... ..0. False (callLinkage is NOT present)
Open Type Length: 17
CallIdentifier
Extension Bit: 0... .... False
guid: 33F68493D06711D380119EE14B943CDA
Small Number Bit: 0... .... False
Number of Sequence Extensions: 3
Extension Present Bit: .... ...0 False (tokens is NOT present)
Extension Present Bit: 0... .... False (cryptoTokens is NOT present)
Extension Present Bit: .0.. .... False (integrityCheckValue is NOT present)
Extension Present Bit: ..1. .... True (needResponse is present)
Open Type Length: 1
needResponse: 0... .... False
- Prev by Date: Re: [Ethereal-dev] Patch: better decoding of NTLMSSP address list
- Previous by thread: Re: [Ethereal-dev] Problems with H.323 dissector(s)
- Next by thread: [Ethereal-dev] Problem with libpcap pcap_next() method
- Index(es):
- Get Wireshark
- Download
- Code of Conduct