Wireshark · Ethereal-dev: Re: [Ethereal-dev] [PATCH] T.38 dissector improvements

["Martin Regner" <martin.regner@xxxxxxxxx>]

Ronnie Sahlberg wrote:
> Can you not change
>   packet#928  OpenLogicalChannel (t38fax)
>   packet#932  OpenLogicalChannelAck
>
> so that if they detect it as being a t38 channel   that it will change the
> conversation to be t38 instead?

Actually I don't think that it is so easy to do this. I haven't had time to
look so much about it yet, but...
I guess I would need to store information from the OpenLogicalChannel so
that it is stored for that specific call (h225/h245 session and Q.931 call
reference - at least if multiplexing is used) to indicate what media is used
for each logical channel for that specific call and then when I get the
OpenLogicalChannelAck I could retrieve that information when the
MediaChannel is dissected.
But if there was no OpenLogicalChannel element in the capture it is not
possible to determine if it is RTP or something else.

>     conv=find_conversation(&src_addr, &src_addr, PT_UDP, ipv4_port,
> ipv4_port, NO_ADDR_B|NO_PORT_B);
>     if(conv){
>         conversation_delete(...
>     }

There is no conversation_delete.

Actually I made a try with changing the dissector used for the conversation
with conversion_set_dissector (a quick hack where I used a global variable
to store the information about if OLC contained T.38) and then the packets
are dissected with the right dissector the first time, but then when you
later click on a RTP packet it is dissected with the T.38 dissector. So the
information will look OK in the summary, but you will get Malformed Packet
when you want to look closer on the packet.