Wireshark-users: Re: [Wireshark-users] why these packets are LAPD?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 12 Jan 2009 20:14:42 -0800

On Jan 12, 2009, at 7:45 PM, ping wen wrote:

I am using wireshark study h.248. Before start megaco protocol, the gateway connect mgc for Ip and phone num map. But wireshark found this connect use LAPD and Q.931. I don't why these packtes are looked as LAPD? In my mind, LAPD is layer 2 protocol, and my layer 2 is ethernet undoubtly.

Yes, but there are a lot of different mechanisms for transporting various types of layer 2 protocols on top of other higher-level protocols.

Cisco, apparently, sends Q.931 atop LAPD inside UDP:

	http://www.cisco.com/en/US/docs/ios/12_0t/12_0t3/feature/guide/rlm_123.html

How does wireshare judge these LAPD packts?

The Wireshark dissector for Cisco's RLM (Redundant Link Management) feature tries to "guess" which UDP packets have Q.931-atop-LAPD - but it does it with a *VERY* weak scheme; it only checks the port number for ports in the range 3001-3015. Unfortunately, if non-RLM traffic goes over UDP ports 3001-3015, that can cause Wireshark to treat that traffic as RLM traffic even if it isn't.

The RLM dissector needs to use a better heuristic - one that looks at the packet *data* - as those packets don't look like valid LAPD packets.