Wireshark · Ethereal-users: RE: [Ethereal-users] help

["Martin Regner" <martin.regner@xxxxxxxxx>]

Massimo Fransecow Lulleri wrote:
<I have a ethereal verion 9.11, I'm using it to see the Voip messages, unfortunately I don't able to see the
<Q.931 and H.323 when I'm doing the caprure during a Voip call.
<Please can you help me?

In order to dissect the H.323 messages (H.245/H.225) you'll need the H.323-plugin (Read the info on www.voice2sniff.org).
Unfortunately there is only a binary version for Windows. 

However you should normally be able to see the TPKT encapsulated Q.931 messages even without the H.323-plugin if the traffic isn't encrypted or similar.

There is a sample H.323 capture attached to the following message:
http://www.ethereal.com/lists/ethereal-dev/200303/msg00049.html


Regards,
  Martin