Wireshark · Ethereal-dev: [Ethereal-dev] H248 package over TCP

[Paraskevopoulos Pavlos <ppar@xxxxxxxxxxx>]

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-dev@xxxxxxxxxxxxx.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-dev
-------------------

Hi,

Due to our needs in using ethereal to trace H248 binary packages, we 
have made some additions to h248-package-template.
We added the udp and tcp port, as well as the pasring of some events and 
signals.

I am sending the changes to the list.

Paul

Index: packet-h248-template.c
===================================================================
--- packet-h248-template.c	(revision 18189)
+++ packet-h248-template.c	(working copy)
@@ -48,6 +48,7 @@
 #include <epan/dissectors/packet-q931.h>
 #include <epan/dissectors/packet-alcap.h>
 #include <epan/dissectors/packet-mtp3.h>
+#include <epan/dissectors/packet-tpkt.h>
 
 #include <epan/sctpppids.h>
 #define PNAME  "H.248 MEGACO"
@@ -55,6 +56,7 @@
 #define PFNAME "h248"
 
 #define GATEWAY_CONTROL_PROTOCOL_USER_ID 14
+#define PORT_MEGACO_BIN 2945
 
 /* Initialize the protocol and registered fields */
 static int proto_h248				= -1;
@@ -102,8 +104,10 @@
 static int hf_h248_package_annex_C_stc = -1;
 static int hf_h248_package_annex_C_uppc = -1;
 
+static int hf_h248_package_annex_E_nt_jit = -1;
+static int hf_h248_package_annex_E_nt_netfail = -1;
+static int hf_h248_package_annex_E_nt_qualert = -1;
 
-
 static int hf_h248_package_3GUP_Mode = -1;
 static int hf_h248_package_3GUP_UPversions = -1;
 static int hf_h248_package_3GUP_delerrsdu = -1;
@@ -159,6 +163,8 @@
 static gboolean keep_persistent_data = FALSE;
 static guint32 udp_port = 0;
 static guint32 temp_udp_port = 0;
+static guint32 tcp_port = 0;
+static guint32 temp_tcp_port = 0;
 
 
 static proto_tree *h248_tree;
@@ -166,8 +172,9 @@
 
 static dissector_handle_t h248_handle;
 static dissector_handle_t h248_term_handle;
+static dissector_handle_t h248_udp_handle;
+static dissector_handle_t h248_tcp_handle;
 
-
 static const value_string package_name_vals[] = {
   {   0x0000, "Media stream properties H.248.1 Annex C" },
   {   0x0001, "g H.248.1 Annex E" },
@@ -333,8 +340,47 @@
   {   0x00010000, "g H.248.1 Annex E" },
   {   0x00010001, "g, Cause" },
   {   0x00010002, "g, Signal Completion" },
-  {   0x00210000, "Generic Bearer Connection Q.1950 Annex A" },
-  {   0x00210001, "GB BNC change" },
+	{ 	0x00040000, "tonedet H.248.1 Annex E" },
+	{ 	0x00040001, "tonedet, Start Tone Detected" },
+	{ 	0x00040002, "tonedet, End Tone Detected" },
+	{ 	0x00040003, "tonedet, Long Tone Detected" },
+	{ 	0x00060000, "dd H.248.1 Annex E" },
+	{ 	0x00060001, "dd/std" },
+	{ 	0x00060002, "dd/etd" },
+	{ 	0x00060003, "dd/ltd" },
+	{ 	0x00060004, "dd, Completion Event" },
+	{ 	0x00060010, "dd/d0" },
+	{ 	0x00060011, "dd/d1" },
+	{ 	0x00060012, "dd/d2" },
+	{ 	0x00060013, "dd/d3" },
+	{ 	0x00060014, "dd/d4" },
+	{ 	0x00060015, "dd/d5" },
+	{ 	0x00060016, "dd/d6" },
+	{ 	0x00060017, "dd/d7" },
+	{ 	0x00060018, "dd/d8" },
+	{ 	0x00060019, "dd/d9" },
+	{ 	0x00060020, "dd/d*" },
+	{ 	0x00060021, "dd/d#" },
+	{ 	0x0006001a, "dd/dA" },
+	{ 	0x0006001b, "dd/dB" },
+	{ 	0x0006001c, "dd/dC" },
+	{ 	0x0006001d, "dd/dD" },
+	{ 	0x00090000, "al H.248.1 Annex E" },
+	{ 	0x00090004, "al onHook" },
+	{ 	0x00090005, "al offHook" },
+	{ 	0x00090006, "al flash" },
+	{ 	0x000a0000, "ct H.248.1 Annex E" },
+	{ 	0x000a0005, "ct, Completion of Continuity test" },
+	{ 	0x000b0000, "nt H.248.1 Annex E" },
+	{ 	0x000b0005, "nt, netFail" },
+	{ 	0x000b0006, "nt, Quality Alert" },
+	{ 	0x000c0000, "rtp H.248.1 Annex E" },
+	{ 	0x000c0001, "rtp, Payload Transition" },
+	{ 	0x00210000, "Generic Bearer Connection Q.1950 Annex A" },
+	{ 	0x00210001, "GB BNC change" },
+	{ 	0x00450000, "Inactivity Timer H.248.14" },
+	{ 	0x00450001, "it/ito" },
+	{ 	0x00450002, "it/ito" },
   {   0x800a0000, "Nokia Bearer Characteristics Package" },
 	{0,     NULL}
 };
@@ -345,6 +391,62 @@
 static const value_string signal_name_vals[] = {
   {   0x00000000, "Media stream properties H.248.1 Annex C" },
   {   0x00010000, "g H.248.1 Annex E" },
+	{ 	0x00030000, "tonegen H.248.1 Annex E" },
+	{ 	0x00030001, "tonegen, Play Tone" },
+	{ 	0x00050000, "dg H.248.1 Annex E" },
+	{ 	0x00050010, "dg, DTMF 0" },
+	{ 	0x00050011, "dg, DTMF 1" },
+	{ 	0x00050012, "dg, DTMF 2" },
+	{ 	0x00050013, "dg, DTMF 3" },
+	{ 	0x00050014, "dg, DTMF 4" },
+	{ 	0x00050015, "dg, DTMF 5" },
+	{ 	0x00050016, "dg, DTMF 6" },
+	{ 	0x00050017, "dg, DTMF 7" },
+	{ 	0x00050018, "dg, DTMF 8" },
+	{ 	0x00050019, "dg, DTMF 9" },
+	{ 	0x00050020, "dg, DTMF *" },
+	{ 	0x00050021, "dg, DTMF #" },
+	{ 	0x0005001a, "dg, DTMF A" },
+	{ 	0x0005001b, "dg, DTMF B" },
+	{ 	0x0005001c, "dg, DTMF C" },
+	{ 	0x0005001d, "dg, DTMF D" },
+	{ 	0x00070000, "cg H.248.1 Annex E" },
+	{ 	0x00070030, "cg, DialTone" },
+	{ 	0x00070031, "cg, RingingTone" },
+	{ 	0x00070032, "cg, BusyTone" },
+	{ 	0x00070033, "cg, CongestionTone" },
+	{ 	0x00070034, "cg, SpecialInformationTone" },
+	{ 	0x00070035, "cg, (Recording) WarningTone" },
+	{ 	0x00070036, "cg, PayphoneRecognitionTone" },
+	{ 	0x00070037, "cg, CallWaitingTone" },
+	{ 	0x00070038, "cg, CallerWaitingTone" },
+	{ 	0x00090000, "al H.248.1 Annex E" },
+	{ 	0x00090002, "al, ringing" },
+	{ 	0x000a0000, "ct H.248.1 Annex E" },
+	{ 	0x000a0003, "ct, Continuity Test" },
+	{ 	0x000a0004, "ct, Respond" },
+	{ 	0x000d0000, "tdmc H.248.1 Annex E" },
+	{ 	0x000d0008, "tdmc, Echo Cancellation" },
+	{ 	0x000d000a, "tdmc, Gain Control" },
+	{ 	0x001d0000, "Generic Announcement H.248.7" },
+	{ 	0x001d0001, "an/apf" },
+	{ 	0x003b0000, "Enhanced alerting H.248.23" },
+	{ 	0x003b0001, "alert/ri" },
+	{ 	0x003b0002, "alert/rs" },
+	{ 	0x003b0003, "alert/cw" },
+	{ 	0x003c0000, "Analog display signalling H.248.23" },
+	{ 	0x003c0001, "andisp/ri" },
+	{ 	0x003c0002, "andisp/rs" },
+	{ 	0x003c0003, "andisp/cw" },
+	{ 	0x003c0004, "andisp/dwa" },
+	{ 	0x003c0005, "andisp/data" },
+	{ 	0x00430000, "Extended analog line supervision H.248.26" },
+	{ 	0x00430003, "xal/las" },
+	{ 	0x00430004, "xal/nd" },
+	{ 	0x00440000, "Automatic metering H.248.26" },
+	{ 	0x00440001, "amet/em" },
+	{ 	0x00440002, "amet/mbp" },
+	{ 	0x00450000, "Inactivity Timer H.248.14" },
   {   0x00210000, "GB Generic Bearer Connection Q.1950 Annex A" },
   {   0x00210001, "GB Establish BNC" },
   {   0x00210002, "GB Modify BNC" },
@@ -547,9 +649,9 @@
 };
 
 static const value_string wildcard_modes[] = {
-    { 0, "All" },
-    { 1, "Choose" },
-    { 0, NULL }
+    { 0, "Choose" },
+    { 1, "All"    },
+    { 0, NULL 	  }
 };
 
 static const value_string wildcard_levels[] = {
@@ -575,7 +677,7 @@
     { H248_CMD_AUDITCAP_REQ, "auditCapReq"},
     { H248_CMD_AUDITVAL_REQ, "auditValReq"},
     { H248_CMD_NOTIFY_REQ, "notifyReq"},
-    { H248_CMD_SVCCHG_REQ, "svcChgReq"},
+    { H248_CMD_SVCCHG_REQ, "serviceChangeReq"},
     { H248_CMD_TOPOLOGY_REQ, "topologyReq"},
     { H248_CMD_CTX_ATTR_AUDIT_REQ, "ctxAttrAuditReq"},
     { H248_CMD_ADD_REPLY, "addReply"},
@@ -585,7 +687,7 @@
     { H248_CMD_AUDITCAP_REPLY, "auditCapReply"},
     { H248_CMD_AUDITVAL_REPLY, "auditValReply"},
     { H248_CMD_NOTIFY_REPLY, "notifyReply"},
-    { H248_CMD_SVCCHG_REPLY, "svcChgReply"},
+    { H248_CMD_SVCCHG_REPLY, "serviceChangeReply"},
     { H248_CMD_TOPOLOGY_REPLY, "topologyReply"},
     { 0, NULL }
 };
@@ -851,6 +953,22 @@
 	}
 }
 
+static void dissect_h248_annex_E_PDU(gboolean implicit_tag, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint16 name_minor) 
+{
+	int offset = 0;
+	tvbuff_t *new_tvb;
+	int len;
+
+	switch ( name_minor ){
+		case 0x0001 :
+			printf("Generic\r\n");
+			break;
+		case 0x0002 :
+			printf("Base Root Package\r\n");
+			break;
+	}
+}
+
 static const value_string h248_3GUP_Mode_vals[] = {
   {   0x00000001, "Transparent mode" },
   {   0x00000002, "Support mode for predefined SDU sizes" },
@@ -944,8 +1062,21 @@
 			dissect_h248_annex_C_PDU(implicit_tag, tvb, pinfo, tree, name_minor);
 			break;
 		case 0x0001: /* g H.248.1 Annex E */
-			proto_tree_add_text(tree, tvb, 0, tvb_length_remaining(tvb, offset), "H.248: Dissector for Package/ID:0x%04x not implemented (yet).", name_major);
+			dissect_h248_annex_E_PDU(implicit_tag, tvb, pinfo, tree, name_minor);
 			break;
+		case 0x000b:
+			switch (name_minor) {
+				case 0x0007 :
+					offset = dissect_ber_integer(TRUE, pinfo, tree, tvb, offset, hf_h248_package_annex_E_nt_jit, NULL);
+					break;
+				case 0x0005 :
+					offset = dissect_ber_octet_string(TRUE, pinfo, tree, tvb, offset, hf_h248_package_annex_E_nt_netfail, NULL);
+					break;
+				case 0x0006 :
+					offset = dissect_ber_integer(TRUE, pinfo, tree, tvb, offset, hf_h248_package_annex_E_nt_qualert, NULL);
+					break;
+			}
+			break;
 		case 0x000d: /* tdmc H.248.1 Annex E */
 			switch (name_minor){
 				case 0x0008: /*ec*/
@@ -1574,6 +1705,15 @@
 
 }
 
+static gchar* h248_term_to_str(h248_term_t* term) {
+    if ( !term ) return "-";
+
+    if (strcasecmp(term->str,"FFFFFFFFFFFFFFFF")==0) {
+        return ep_strdup_printf("%s","ROOT");
+    }
+    return ep_strdup_printf("%s",term->str);
+}
+
 static gchar* h248_cmd_to_str(h248_cmd_t* c) {
     gchar* s = "-";
     h248_terms_t* term;
@@ -1585,69 +1725,70 @@
             return "-";
             break;
         case H248_CMD_ADD_REQ:
-            s = "AddReq {";
+            s = "AddReq =";
             break;
         case H248_CMD_MOVE_REQ:
-            s = "MoveReq {";
+            s = "MoveReq =";
             break;
         case H248_CMD_MOD_REQ:
-            s = "ModReq {";
+            s = "ModReq =";
             break;
         case H248_CMD_SUB_REQ:
-            s = "SubReq {";
+            s = "SubReq =";
             break;
         case H248_CMD_AUDITCAP_REQ:
-            s = "AuditCapReq {";
+            s = "AuditCapReq =";
             break;
         case H248_CMD_AUDITVAL_REQ:
-            s = "AuditValReq {";
+            s = "AuditValReq =";
             break;
         case H248_CMD_NOTIFY_REQ:
-            s = "NotifyReq {";
+            s = "NotifyReq =";
             break;
         case H248_CMD_SVCCHG_REQ:
-            s = "SvcChgReq {";
+            s = "SvcChgReq =";
             break;
         case H248_CMD_TOPOLOGY_REQ:
-            s = "TopologyReq {";
+            s = "TopologyReq =";
             break;
         case H248_CMD_CTX_ATTR_AUDIT_REQ:
-            s = "CtxAttribAuditReq {";
+            s = "CtxAttribAuditReq =";
             break;
         case H248_CMD_ADD_REPLY:
-            s = "AddReply {";
+            s = "AddReply =";
             break;
         case H248_CMD_MOVE_REPLY:
-            s = "MoveReply {";
+            s = "MoveReply =";
             break;
         case H248_CMD_MOD_REPLY:
-            s = "ModReply {";
+            s = "ModReply =";
             break;
         case H248_CMD_SUB_REPLY:
-            s = "SubReply {";
+            s = "SubReply =";
             break;
         case H248_CMD_AUDITCAP_REPLY:
-            s = "AuditCapReply {";
+            s = "AuditCapReply =";
             break;
         case H248_CMD_AUDITVAL_REPLY:
-            s = "AuditValReply {";
+            s = "AuditValReply =";
             break;
         case H248_CMD_NOTIFY_REPLY:
-            s = "NotifyReply {";
+            s = "NotifyReply =";
             break;
         case H248_CMD_SVCCHG_REPLY:
-            s = "SvcChgReply {";
+            s = "SvcChgReply =";
             break;
         case H248_CMD_TOPOLOGY_REPLY:
-            s = "TopologyReply {";
+            s = "TopologyReply =";
             break;
         case H248_CMD_REPLY:
-            s = "ActionReply {";
+            s = "ActionReply =";
             break;
     }
 
     for (term = c->terms.next; term; term = term->next) {
-        s = ep_strdup_printf("%s %s",s,term->term->str);
+        /* s = ep_strdup_printf("%s %s",s,term->term->str); */
+	s = ep_strdup_printf("%s %s",s,h248_term_to_str(term->term));
     };
 
     if (c->error) {
@@ -1655,27 +1796,63 @@
     }
 
 
-    return ep_strdup_printf("%s }", s);
+    return ep_strdup_printf("%s", s);
 }
 
+static gchar* h248_ctx_to_str(guint32 ctxid) { // intra
+    gchar* s;
+
+    switch (ctxid) {
+        case 0:
+            s = "-";
+            break;
+        case 0xFFFFFFFE:
+            s = "$";
+            break;
+		case 0xFFFFFFFF:
+            s = "*";
+            break;
+        default:
+            s = ep_strdup_printf("%u",ctxid);
+    }
+    return ep_strdup_printf("%s",s);
+}
+
 static gchar* h248_trx_to_str(h248_msg_t* m, h248_trx_t* t) {
     gchar* s;
     h248_cmd_msg_t* c;
 
     if ( !m || !t ) return "-";
 	
-	s = ep_strdup_printf("T %x { ",t->id);
+    switch (t->type) {
+        case H248_TRX_PENDING:
+            s = ep_strdup_printf("PN=%u{",t->id);
+            break;
+        case H248_TRX_REPLY:
+            s = ep_strdup_printf("P=%u{",t->id);
+            break;
+        case H248_TRX_ACK:
+            s = ep_strdup_printf("K=%u{",t->id);
+            break;
+        case H248_TRX_REQUEST:
+            s = ep_strdup_printf("T=%u{",t->id);
+            break;
+        default:
+            s = ep_strdup_printf("?=%u{",t->id);
+            break;
+    }
+	
 
     if (t->cmds) {
         if (t->cmds->cmd->ctx) {
-            s = ep_strdup_printf("%s C %x {",s,t->cmds->cmd->ctx->id);
+            s = ep_strdup_printf("%sC=%s{",s,h248_ctx_to_str(t->cmds->cmd->ctx->id));  //intra
 
             for (c = t->cmds; c; c = c->next) {
                 if (c->cmd->msg == m)
-                    s = ep_strdup_printf("%s %s",s,h248_cmd_to_str(c->cmd));
+                    s = ep_strdup_printf("%s%s}",s,h248_cmd_to_str(c->cmd));   //intra
             }
 
-            s = ep_strdup_printf("%s %s",s,"}");
+            //s = ep_strdup_printf("%s%s",s,"}");  //intra
         }
     }
 
@@ -1683,7 +1860,7 @@
         s = ep_strdup_printf("%s Error=%i",s,t->error);
     }
 
-    return ep_strdup_printf("%s %s",s,"}");
+    return ep_strdup_printf("%s%s",s,"}");
 }
 
 static gchar* h248_msg_to_str(h248_msg_t* m) {
@@ -1840,7 +2017,29 @@
 
 }
 
+static void dissect_tcp_h248(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+	int lv_tpkt_len;
 
+	/* This code is copied from the Q.931 dissector, some parts skipped.
+	 * Check whether this looks like a TPKT-encapsulated
+	 * MEGACO packet.
+	 *
+	 * The minimum length of a MEGACO message is 6?:
+	 * Re-assembly ?
+	 */
+	lv_tpkt_len = is_tpkt(tvb, 6);
+	if (lv_tpkt_len == -1) {
+		/*
+		 * It's not a TPKT packet;
+		 * Is in MEGACO ?
+		 */
+		dissect_h248(tvb, pinfo, tree);
+		return;
+	}
+	dissect_tpkt_encap(tvb, pinfo, tree, TRUE, h248_udp_handle);
+}
+
 static void h248_init(void)  {
 
     if (!h248_prefs_initialized) {
@@ -1848,13 +2047,21 @@
     } else {
         if ( udp_port )
             dissector_delete("udp.port", udp_port, h248_handle);
+				if ( tcp_port )
+						dissector_delete("tcp.port", tcp_port, h248_tcp_handle);
+				
 	}
     
     udp_port = temp_udp_port;
-    
+    tcp_port = temp_tcp_port;
+		
     if ( udp_port ) {
 		dissector_add("udp.port", udp_port, h248_handle);
 	}
+    if ( tcp_port ) {
+		dissector_add("tcp.port", tcp_port, h248_tcp_handle);
+	}
+
     
 }
 
@@ -2113,6 +2320,11 @@
                                  "Port to be decoded as h248",
                                  10,
                                  &temp_udp_port);
+	prefs_register_uint_preference(h248_module, "tcp_port",
+                                 "TCP port",
+                                 "Port to be decoded as h248 (TCP)",
+                                 10,
+                                 &temp_tcp_port);
   
   register_init_routine( &h248_init );
 
@@ -2132,5 +2344,12 @@
 
   dissector_add("mtp3.service_indicator", GATEWAY_CONTROL_PROTOCOL_USER_ID, h248_handle);
   dissector_add("sctp.ppi", H248_PAYLOAD_PROTOCOL_ID, h248_handle);
+
+	h248_udp_handle = create_dissector_handle(dissect_h248, proto_h248);
+	dissector_add("udp.port", PORT_MEGACO_BIN, h248_udp_handle);
+	
+	h248_tcp_handle = create_dissector_handle(dissect_tcp_h248, proto_h248);
+	dissector_add("tcp.port", PORT_MEGACO_BIN, h248_tcp_handle);
+
 }
 

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev