Wireshark · Ethereal-dev: Re: [Ethereal-dev] Q.931 patch - reassembly of segmented messages

["Martin Regner" <martin.regner@xxxxxxxxx>]

Guy Harris wrote:
> Well, there's *something* strange going on here - there's a capture
> named "h225-setup.out" that I think was sent to the list at some point,
> and one Q.931-inside-TPKT packet has:
>
> a Q.931 header, for a FACILITY message;
>
> a Facility IE, with a length of 0;
>
> a Display IE, with a length of 19, and display information of
>     "cisco Systems, Inc."[sic - "cisco", not "Cisco"];
>
> a User-user IE, with a length of 153, a protocol
>     discriminator of 5 ("X.208 and X.209 coded user
>     information"), and 152 bytes of H.225.0 stuff;
>
> 4 bytes of 0, which are interpreted as Segmented message IEs
>     with lengths of 0.
>
> Perhaps Cisco is just putting extra padding crap, and perhaps an H.323
> implementation is supposed to ignore whatever IEs come after a User-user
> IE.
>

I think I have found the capture you refer to:
http://www.ethereal.com/lists/ethereal-users/200402/msg00042.html
I can see Segment message IEs for e.g. packet #37

Facility IE with length 0 is correct to use according to H.225 for certain
scenarios.
This is quite normal for H.225 with tunneling, I think.
In this case the Facility message contains a tunneled H.245 message.

Using Segment message IE in H.225 is not correct what I can see in H.225
specification.
There is a specific chapter about Segment message where it says "shall not
be used".

You are also not supposed to send more than one IE of the same type in a
H.225 message.
These messages contains two Segment message IEs with zero length.

I don't think that H.323 says that you should always ignore IEs after
User-User IE, but it seems OK to ignore
unknown information elements (however I haven't checked all the details
regarding that).

I think that the extra octets is due to some implementation mistake.

I haven't tried the capture with the CVS version of Ethereal yet since I
haven't yet fetched the code and built it.
Does the strange Segment message IEs cause any problems (assuming that the
length is always 0)?