Wireshark · Wireshark-users: Re: [Wireshark-users] Help on Ethernet Size

["Anders Broman \(AL/EAB\)" <anders.broman@xxxxxxxxxxxx>]

Hi,
I think the H323 dissection is based on the ports used and may not work well if other than
the standard ports are used, a small sample trace from your network may show what the problem is.
 
I'm not sure what you mean by the second question.
Best regards
Anders

________________________________

Från: wireshark-users-bounces@xxxxxxxxxxxxx genom ARAMBULO, Norman R.
Skickat: on 2007-03-07 11:05
Till: Wireshark-Users (E-mail); Wireshark-users-request (E-mail); Tcpdump-Workers-Owner (E-mail); Tcpdump-Workers (E-mail)
Ämne: [Wireshark-users] Help on Ethernet Size


Yeah based on wiki, it can show the calling/called number but for our case when we try 
it on our network to check our voip call we cant see it, when we try to run other software
it show h323 & h225 voip call. BTW why do does program show h323 & h225 is it different 
protocol, but according to ITU h225 is a part of h323 standards? Can someone enlighten me.
Thanks
 
Wireshark-users: Re: [Wireshark-users] FW: [tcpdump-workers] Help on Ethernet Size
Date Index Thread Index Other Months All Mailing Lists
[Date Prev] | [Date Next] | [Thread Prev] | [Thread Next]
 
From: "Anders Broman" <a.broman@xxxxxxxxx>
Date: Wed, 7 Mar 2007 07:29:18 +0100
 
Hi,
Wireshark can already do that, take a look at the wiki page and
the VoIP protocol family page.
Best regards
Anders
 
-----Ursprungligt meddelande-----
Från: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För ARAMBULO, Norman R.
Skickat: den 7 mars 2007 06:50
Till: Tcpdump-Workers (E-mail); Wireshark-Users (E-mail);
Wireshark-users-request (E-mail); Tcpdump-Workers-Owner (E-mail)
Ämne: [Wireshark-users] FW: [tcpdump-workers] Help on Ethernet Size
 
Ok so it a lot of work, Can wireshark show the calling/called number
vice-versa?
I wanna sniff the calling/called numbers in our H323 voip calls..
 
So what language can you recommend using for such task? for Thanks
 
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 6 Mar 2007 18:31:46 -0800
On Mar 6, 2007, at 6:28 PM, ARAMBULO, Norman R. wrote:
 
Thanks for the enlightenment that helps a lot... Another 
thing how can I parse a voip call (h323 family, SIP, IAX etc.) Is 
wireshark capable of doing it.
 
Yes.
 
Can somebody send me a source code for parsing voip call in C language. 
 
http://www.wireshark.org/download/src/wireshark-0.99.5.tar.gz
 
:-)
 
Even if you strip out everything except the link-layer, IP, TCP, and SCTP 
dissectors, and the protocols running atop them in VoIP calls, and all the 
facilities in the Wireshark core that aren't needed to support those
dissectors, 
that's a *lot* of code. Dissecting packets isn't something you can do with a
 
quick little bit of C code.
 
Now, if by "parsing" you meant "constructing and sending, and receiving and 
processing" - i.e., you want to implement VoIP - there are other
free-software 
projects for that (Asterix, for example). However, for those, see the
previous 
paragraph; that's still a *lot* of code.
 
-----Original Message-----
From: tcpdump-workers-owner@xxxxxxxxxxxxxxxxx
[mailto:tcpdump-workers-owner@xxxxxxxxxxxxxxxxx]On Behalf Of Guy Harris
Sent: Wednesday, March 07, 2007 10:07 AM
To: Community support list for Wireshark
Cc: Tcpdump-Workers (E-mail)
Subject: Re: [tcpdump-workers] [Wireshark-users] Help on Ethernet Size
 

(the -request address for a mailing list is for requests to be added  
to or removed from a mailing list; it is not for messages sent to the  
list itself)
 
On Mar 6, 2007, at 5:36 PM, ARAMBULO, Norman R. wrote:
> Is the ethernet size always equal to 14 bytes?
 
The lowest-layer Ethernet header is always 14-bytes long - 6 bytes of  
destination address, 6 bytes of source address, and 2 bytes of type/ 
length field.  If the type/length field is > 1500 (or some number  
close to that - I forget the exact number, and the 802.3 spec has a  
range which is neither a valid type value nor a valid length value),  
it's a type field, and the value in it is the protocol running atop  
Ethernet (for example, hex 800 for IPv4).  If it's 1500 or less, it's  
a length field, and the Ethernet header is supposed to be followed by  
an IEEE 802.2 header (although Novell had a scheme in which it was  
immediately followed by an IPX header).
> and based on wireshark verbose is the frame part of the IP header?
 
What do you mean by "the frame"?
 
The packet details pane (by default, the bottommost pane) has, for an  
IPv4-over-Ethernet packet, a "Frame" protocol at the top, followed by  
an "Ethernet II" protocol, followed by an "IP" protocol.
 
"Frame" is not part of the packet data; it displays "metadata" such as  
the time stamp of the packet (which is *approximately* the time the  
packet arrived at the host that captured it), the total length of the  
packet data, and the number of bytes of packet data that were  
captured.  The "Ethernet II" protocol has the Ethernet header (14  
bytes), and the "IP" protocol has the IPv4 header.
 
Nothing in the "Frame" protocol comes from the packet data, so, in  
particular, it doesn't come from the IP header.
> Does wireshark insert = Protocols in frame: eth:ip:tcp:data or its  
> is part of the IP Header.
 
Wireshark inserts that.  It is *NOT* part of any packet data.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users

 "Reality is merely an illusion, albeit a very persistent one."

                                                                                                                -- Albert Einstein

  <https://mail.eemea.ericsson.se/exchange/anders.broman/Drafts/SV:%20%5BWireshark-users%5D%20Help%20on%20Ethernet%20Size.EML/1_multipart/image001.gif>

<<winmail.dat>>