Ethereal-dev: Re: SV: [Ethereal-dev] [PATCH] Q.931 fails to pass long message to H.225

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 16 Nov 2005 23:44:38 +0100 (CET)
Hi Anders,

That's weird. I did a 'svn update', 'make clean' and 'make' but still got
the same result....

---------------------------------------------------------------------------
Version 0.10.13 (SVN 20051116202529) (C) 1998-2005 Gerald Combs <gerald@xxxxxxxxxxxx>

Compiled with GTK+ 2.6.10, with GLib 2.8.3, with libpcap 0.9.4, with libz 1.2.3,
without libpcre, without UCD-SNMP or Net-SNMP, without ADNS.
NOTE: this build doesn't support the "matches" operator for Ethereal filter
syntax.

Running with libpcap version 0.9.4 on Linux 2.4.27-2-386.
--------------------------------------------------------------------------

This is the detailed dissection as I got it, now and before.

--------------------------------------------------------------------------
Frame 1 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 00:11:85:15:68:7b (00:11:85:15:68:7b), Dst: 00:60:08:4d:38:b5 (00:60:08:4d:38:b5)
Internet Protocol, Src: 130.139.45.128 (130.139.45.128), Dst: 192.168.18.4 (192.168.18.4)
Transmission Control Protocol, Src Port: 2284 (2284), Dst Port: 2050 (2050), Seq: 0, Ack: 0, Len: 1460
TPKT, Version: 3, Length: 1799
Q.931
    Protocol discriminator: Q.931
    Call reference value length: 2
    Call reference flag: Message sent from originating side
    Call reference value: 588C
    Message type: SETUP (0x05)
  > Bearer capability
  > Display  'frans\000'
  > Called party number: '2003'
  v User-user
        Information element: User-user
        Length: 1767
        Protocol discriminator: X.208 and X.209 coded user information
[Packet size limited during capture: Q.931 truncated]
--------------------------------------------------------------------------

You can get the same result when you switch on the TCP option 'Validate
the TCP checksum if possible'. I wonder why this is?

Thanx,
Jaap


On Wed, 16 Nov 2005, Anders Broman wrote:

> Hi,
> It displays reassembled on the latest Ethereal SVN version, without any
> patch.
> Brg
> Anders
>
> -----Ursprungligt meddelande-----
> Fr?n: ethereal-dev-bounces@xxxxxxxxxxxx
> [mailto:ethereal-dev-bounces@xxxxxxxxxxxx] F?r Jaap Keuter
> Skickat: den 16 november 2005 17:55
> Till: Ethereal Developer Mailinglist
> ?mne: [Ethereal-dev] [PATCH] Q.931 fails to pass long message to H.225
>
> Hi list,
>
> Someone tossed me this capture which he expected to be reassembled. We
> checked all the reassemble check boxes on TCP, TPKT, Q.931 but to no
> avail. Searching through the code I came up with this oneliner, which
> does not accomplish reassembly, but does break the dissection less
> severly.
>
> Thanx,
> Jaap
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>