Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] Tap query (Voip Calls)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Mathieson" <martin.mathieson@xxxxxxxxxxxx>
Date: Sun, 13 Feb 2005 23:33:27 -0000
> >
> > (1) The single 'tap reset' function that is passed to
> > register_tap_listener() doesn't distinguish between:
> >         - resetting because new packets are coming
> >         - resetting because the same packets are going to scanned again.
> reset functions should be called only for the second reason. If it is
> called whenever new packets are coming, it is a bug. I had to change the
> original voip call analysis tap to make it use "reset" and "draw"
> functions correctly.
> Due to lack of time I haven't had a look at the rtp analysis tap, but I
> suspect it to have the same bugs as the original VoIP tap, as the latter
> used it as a basis.

By the first reason, I really meant new packets as in:
- a new capture file being loaded, or
- a new actual capture being started, or maybe even
- the current list of packets being closed

i.e. packets that could be ignored by an up-to-date tap.  This would be
complicated by allowing filters to be applied to the tap of course, so
perhaps this isn't really an option.

> > (2)  Change Voip Calls to use fixed rather than dynamic memory, so that
if
> > the same packets are re-tapped the same details go back into the same
memory
> > addresses and the Graph Analysis window will continue to refer to valid
> > data.
> >
> Well, it uses fixed memory (at least the structure to hold basic tap
> information is static, while the "per call" data has to be dynamic). I
> plan to change it to use dynamic memory to allow calling it more than
> once, e.g. with different tap packet filter expressions. However this
> feature will take some time to develop, as it will require some
> additional "pointer magic".
>
> So what exactly should be changed to use fixed instead of dynamic memory.

Whenever voip_calls_init_tap() is called, it frees up the list of
graph_analysis_item_t's held in the graph_analysis_info_t.

dialog_graph_draw() works out which items are in view each time and copies
data from graph_analysis_info_t structures into an array of display_items_t
structures.  When the retapping has happened, mostly the items are not drawn
because the graph_analysis_info_t 'display' fields are reset to FALSE.

> Hmm, strange things happen with your ethereal, is it up to date?
> Currently the graph analysis window gets updated only when you press the
> "Graph" button in the Call Analysis window. It fetches the selected data
> at "click" time and I see no problem with that, as the Call Analysis
> window is always up to date and even recognizes loading of new capture
> files.
>
> Can you provide a scheme, how you trigger the bugs you are reporting, so
> I can reproduce them?

My ethereal is up to date, the only diffs I have I'm pretty sure are not
affecting this.

You can hopefully see this behaviour in the following way:
- Load a file with at least one VoIP call, including RTP (an H.323 call with
more rows than the default window size would be ideal)
- Open up 'Voip Calls' and display the graph for a call.
- With that still open, choose 'Statistics | RTP | Show all streams...'
- Now try clicking the up and down scroll buttons on the Graph Analysis
window...

Regards,
Martin