Wireshark · Ethereal-dev: RE: [Ethereal-dev] H323 Call analysis

["Alejandro Vaquero" <alejandrovaquero@xxxxxxxxx>]

> 2. Whenever a h225 packets is seen, it is checked whether it is
already
> part of a conversation (should the word "call" be used instead of
> conversation?) in the list. The check is done using the ip/port pair
> combination (should we use some other parameters as well - CALL ID?).
If
> not, it is added to the list. At this time we also look for the h.245
> address which is normally provided in h225 connect message. We need
this
> address to follow the h245 part of the call in case there is no
> faststart. If h245 packet arrives, it is checked to which call does it
> belong (based on ip/port) and the counter is increased. If h245 packet
> is seen without appropriate h225 part, it is skipped (f.e. in case the
> capturing started after the h225 phase). 

Maybe you can also add the calling and called number for voice calls in
the list of "conversations".

Nice tool!

Alejandro