Wireshark · Ethereal-dev: [Ethereal-dev] BER errors in H248 dissector (binary MEGACO)

["Tarlovskij Eugene" <eugene@xxxxxxxxxxxx>]

I am developing a simple application which uses EPAN library and I have a
problem with H248 protocol (binary MEGACO). H248 dissector does not decode
packets.

I have attached the file with sample binary MEGACO data (signaling only). I
am sure it is really binary MEGACO data.
In Ethereal GUI (version 0.99, Windows binary downloaded from site) I cannot
decode those packets as H248. But my application decodes it with errors. 


It is an example of decoded frame 5 from attached file:

H.248 MEGACO
  mess
    version: 1
    mId: domainName (2)
      domainName
        name: company1.com
        portNumber: 2945
    messageBody: transactions (1)
      transactions: 1 item
        Item: transactionRequest (0)
          transactionRequest
            transactionId: 1
            actions: 1 item
              Item
                contextId: Null Context(0)
                contextRequest
                BER Error: Wrong field in SEQUENCE  expected class:2
(CONTEXT) tag:3 but found class:2 tag:1
                BER Error: This field lies beyond the end of the known
sequence definition.

Looks like BER decoder does not decode sequences correctly. Unfortunately, I
do not understand code well enough to make a patch but I think that the
problem is around line packet-ber:1193 . 

I made a quick experiment: changed (len==0) to (len!=0) and dissector
stopped reporting BER errors. It seems to work but I'm afraid of putting new
serious bug with this change. 

Would you explain how to get it work in Ethereal GUI and how to correct
dissector code (in case it is dissector problem)?

Eugene Tarlovskij

Attachment: MegacoBin-filtered.zip
Description: Binary data

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev