Wireshark · Ethereal-dev: [Ethereal-dev] [PATCH] SIP hidden fields for finding errors

["Martin Mathieson" <martin@xxxxxxxxxxxxxxxxxxxxx>]

The attached patches add 2 hidden display filters for SIP - namely:
(1)  sip.error (for all responses with code >= 300)
(2)  sip.resend (for all packets that appear to have been retransmitted). A
field showing a count of these is shown in the SIP stats window.

These filters make it much easier to zero in on problems in large captures
(e.g. bulk call tests) evident from the SIP stats window.

(1) is straightforward, and needed because the response code is regarded as
a string, so its not easy to write your own expression

(2) is more involved, and I would like to hear from other SIP users about
this addition. Some notes:
-  Only considers UDP packets
-  Hash table contains (call_id, source_addr, dest_addr) -> (cseq,
simplified transaction_state).
An earlier version used proper conversations but the call-id is the most
important part of the key.  Addresses are still needed for when e.g. more
than one leg of a proxied call is in the same capture.
-  Size of hash table key and value memchunks (as number of elements) are
settable as a SIP property so as not to waste memory but to still allow
large values

Regards,
Martin

Attachment: sip_stat.c.diff
Description: Binary data

Attachment: packet-sip.h.diff
Description: Binary data

Attachment: packet-sip.c.diff
Description: Binary data