Wireshark · Ethereal-dev: Re: [Ethereal-dev] Print as XML - Status of work?

["Martin Regner" <martin.regner@xxxxxxxxx>]

Gilbert Ramirez wrote:
> I've committed the change to CVS. Update and read the
> doc/README.xml-output file for more information.
>
> To produce PDML from a capture file, use:
>
> tethereal -Tpdml -V -r capturefile
>
> enjoy!

I think that I will have much use of the new feature in the future.
Thanks a lot for providing the new functionality.

However I would also have the possibility to get the hex-data for each PDU
in the
generated PDML document.
Ethereal/Tethereal is a very good tool for reassembling data and so on, but
in some cases I want
to be able to do some post-processing on the reassembled TPKT/H.225/H.245
PDUs or similar.
I have used a modified version of tethereal to dump the complete/reassembled
TPKT PDUs as hex octets in the normal printouts as a temporar solution.

Maybe we could use the "-x" option to specify whether to include the hex
data in the PDML document.

I have attached a very simple patch that I used for some experiments
yesterday and a sample
PDML file I generated.

With the current patch the hex data for the complete frame is given in hex
for proto "frame", but for proto "ip" it's just the hex data for the IP
header and not including the IP payload, and the same for proto "eth", "tcp"
and "tpkt".
This was actually unintended and I haven't looked closer how I could get the
hex data for e.g. the complete
(reassembled) TPKT PDU.

The attached patch is not intended for check-in, but just included as a
preliminar example.

I was also thinking that it may be good to indicate the underlaying protocol
for each proto entry, e.g.
something like below:
<proto name="eth"  baseproto="frame"  ..
 :
</proto>
<proto name="ip" baseproto="eth" ...
 :
</proto>
<proto name="tcp" baseproto="ip"  ...
 :
</proto>
<proto name="tpkt" baseproto="tcp"  ...
 :
</proto>
<proto name="q931" baseproto="tpkt" ...
 :
</proto>
<proto name="h225" baseproto="q931" ...
 :
</proto>
<proto name="tpkt" baseproto="tcp"  ...
 :
</proto>
<proto name="q931" baseproto="tpkt" ...
 :
</proto>
<proto name="h225" baseproto="q931" ...
 :
</proto>

or

<packet>
:
<proto name="frame"   ..
 :
</proto>
<proto name="eth"  protopath="frame"  ..
 :
</proto>
<proto name="ip" protopath="frame/eth" ...
 :
</proto>
<proto name="tcp" protopath="frame/eth/ip"  ...
 :
</proto>
<proto name="tpkt" protopath="frame/eth/ip/tcp"  ...
 :
</proto>
<proto name="q931" protopath="frame/eth/ip/tcp/tpkt" ...
 :
</proto>
<proto name="h225" protopath="frame/eth/ip/tcp/tpkt/q931" ...
 :
</proto>
<proto name="tpkt" protopath="frame/eth/ip/tcp"  ...
 :
</proto>
<proto name="q931" protopath="frame/eth/ip/tcp/tpkt" ...
 :
</proto>
<proto name="h225" protopath="frame/eth/ip/tcp/tpkt/q931" ...
 :
</proto>
</packet>

I haven't looked so much on PDML specifications, so it might be that I have
missed if there is some other mecahnism that can be used for indicating how
the protocols are related.

Attachment: print.c.patch
Description: Binary data

<packet>
  <proto name="geninfo" pos="1" showname="General information" size="142">
    <field name="num" pos="1" show="32" showname="Number" value="20" size="142"/>
    <field name="len" pos="1" show="142" showname="Packet Length" value="8e" size="142"/>
    <field name="caplen" pos="1" show="142" showname="Captured Length" value="8e" size="142"/>
    <field name="timestamp" pos="1" show="Jul 23, 2002 10:45:01.079446000" showname="Captured Time" value="1027413901.079446000" size="142"/>
  </proto>
  <proto name="frame" showname="Frame 32 (142 bytes on wire, 142 bytes captured)" size="142" pos="0">
    <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/>
    <field name="frame.time" showname="Arrival Time: Jul 23, 2002 10:45:01.079446000" size="0" pos="0" show="Jul 23, 2002 10:45:01.079446000"/>
    <field name="frame.time_delta" showname="Time delta from previous packet: 0.006697000 seconds" size="0" pos="0" show="0.006697000"/>
    <field name="frame.time_relative" showname="Time since reference or first frame: 19.498952000 seconds" size="0" pos="0" show="19.498952000"/>
    <field name="frame.number" showname="Frame Number: 32" size="0" pos="0" show="32"/>
    <field name="frame.pkt_len" showname="Packet Length: 142 bytes" size="0" pos="0" show="142"/>
    <field name="frame.cap_len" showname="Capture Length: 142 bytes" size="0" pos="0" show="142"/>
    <field name="frame.file_off" showname="File Offset: 5502 (0x157e)" size="0" pos="0" show="5502"/>
    <field name="hexdata" value="080020f97e8000901a010316080045000080426140003f0686e50a0aaa070a0ab41606b8ff7471fc732f62439c3f8018602863c300000101080a057fbe2b01f035cf0300004c08029c8a027e0040052180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa30100010010800100"/>
  </proto>
  <proto name="eth" showname="Ethernet II, Src: 00:90:1a:01:03:16, Dst: 08:00:20:f9:7e:80" size="14" pos="0">
    <field name="eth.dst" showname="Destination: 08:00:20:f9:7e:80 (08:00:20:f9:7e:80)" size="6" pos="0" show="08:00:20:f9:7e:80" value="080020f97e80"/>
    <field name="eth.src" showname="Source: 00:90:1a:01:03:16 (00:90:1a:01:03:16)" size="6" pos="6" show="00:90:1a:01:03:16" value="00901a010316"/>
    <field name="eth.addr" showname="Source or Destination Address: 08:00:20:f9:7e:80 (08:00:20:f9:7e:80)" size="6" pos="0" show="08:00:20:f9:7e:80" value="080020f97e80"/>
    <field name="eth.addr" showname="Source or Destination Address: 00:90:1a:01:03:16 (00:90:1a:01:03:16)" size="6" pos="6" show="00:90:1a:01:03:16" value="00901a010316"/>
    <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/>
    <field name="hexdata" value="080020f97e8000901a0103160800"/>
  </proto>
  <proto name="ip" showname="Internet Protocol, Src Addr: 10.10.170.7 (10.10.170.7), Dst Addr: 10.10.180.22 (10.10.180.22)" size="20" pos="14">
    <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/>
    <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/>
    <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)" size="1" pos="15" show="0" value="00">
      <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="00"/>
      <field name="ip.dsfield.ect" showname=".... ..0. = ECN-Capable Transport (ECT): 0" size="1" pos="15" show="0" value="00"/>
      <field name="ip.dsfield.ce" showname=".... ...0 = ECN-CE: 0" size="1" pos="15" show="0" value="00"/>
    </field>
    <field name="ip.len" showname="Total Length: 128" size="2" pos="16" show="128" value="0080"/>
    <field name="ip.id" showname="Identification: 0x4261 (16993)" size="2" pos="18" show="0x4261" value="4261"/>
    <field name="ip.flags" showname="Flags: 0x04" size="1" pos="20" show="0x04" value="40">
      <field name="ip.flags.df" showname=".1.. = Don't fragment: Set" size="1" pos="20" show="1" value="40"/>
      <field name="ip.flags.mf" showname="..0. = More fragments: Not set" size="1" pos="20" show="0" value="40"/>
    </field>
    <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/>
    <field name="ip.ttl" showname="Time to live: 63" size="1" pos="22" show="63" value="3f"/>
    <field name="ip.proto" showname="Protocol: TCP (0x06)" size="1" pos="23" show="0x06" value="06"/>
    <field name="ip.checksum" showname="Header checksum: 0x86e5 (correct)" size="2" pos="24" show="0x86e5" value="86e5"/>
    <field name="ip.src" showname="Source: 10.10.170.7 (10.10.170.7)" size="4" pos="26" show="10.10.170.7" value="0a0aaa07"/>
    <field name="ip.addr" showname="Source or Destination Address: 10.10.170.7 (10.10.170.7)" size="4" pos="26" show="10.10.170.7" value="0a0aaa07"/>
    <field name="ip.dst" showname="Destination: 10.10.180.22 (10.10.180.22)" size="4" pos="30" show="10.10.180.22" value="0a0ab416"/>
    <field name="ip.addr" showname="Source or Destination Address: 10.10.180.22 (10.10.180.22)" size="4" pos="30" show="10.10.180.22" value="0a0ab416"/>
    <field name="hexdata" value="45000080426140003f0686e50a0aaa070a0ab416"/>
  </proto>
  <proto name="tcp" showname="Transmission Control Protocol, Src Port: 1720 (1720), Dst Port: 65396 (65396), Seq: 1, Ack: 413, Len: 76" size="32" pos="34">
    <field name="tcp.srcport" showname="Source port: 1720 (1720)" size="2" pos="34" show="1720" value="06b8"/>
    <field name="tcp.dstport" showname="Destination port: 65396 (65396)" size="2" pos="36" show="65396" value="ff74"/>
    <field name="tcp.port" showname="Source or Destination Port: 1720" size="2" pos="34" show="1720" value="06b8"/>
    <field name="tcp.port" showname="Source or Destination Port: 65396" size="2" pos="36" show="65396" value="ff74"/>
    <field name="tcp.len" showname="TCP Segment Len: 76" size="4" pos="34" show="76" value="06b8ff74"/>
    <field name="tcp.seq" showname="Sequence number: 1" size="4" pos="38" show="1" value="71fc732f"/>
    <field name="tcp.nxtseq" showname="Next sequence number: 77" size="0" pos="34" show="77"/>
    <field name="tcp.ack" showname="Acknowledgement number: 413" size="4" pos="42" show="413" value="62439c3f"/>
    <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/>
    <field name="tcp.flags" showname="Flags: 0x0018 (PSH, ACK)" size="1" pos="47" show="0x18" value="18">
      <field name="tcp.flags.cwr" showname="0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="18"/>
      <field name="tcp.flags.ecn" showname=".0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="18"/>
      <field name="tcp.flags.urg" showname="..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="18"/>
      <field name="tcp.flags.ack" showname="...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="18"/>
      <field name="tcp.flags.push" showname=".... 1... = Push: Set" size="1" pos="47" show="1" value="18"/>
      <field name="tcp.flags.reset" showname=".... .0.. = Reset: Not set" size="1" pos="47" show="0" value="18"/>
      <field name="tcp.flags.syn" showname=".... ..0. = Syn: Not set" size="1" pos="47" show="0" value="18"/>
      <field name="tcp.flags.fin" showname=".... ...0 = Fin: Not set" size="1" pos="47" show="0" value="18"/>
    </field>
    <field name="tcp.window_size" showname="Window size: 24616" size="2" pos="48" show="24616" value="6028"/>
    <field name="tcp.checksum" showname="Checksum: 0x63c3" size="2" pos="50" show="0x63c3" value="63c3"/>
    <field show="Options: (12 bytes)" size="12" pos="54" value="0101080a057fbe2b01f035cf">
      <field show="NOP" size="1" pos="54" value="01"/>
      <field show="NOP" size="1" pos="55" value="01"/>
      <field name="tcp.options.time_stamp" showname="TCP Time Stamp Option: True" size="10" pos="56" show="1" value="080a057fbe2b01f035cf"/>
      <field show="Time stamp: tsval 92257835, tsecr 32519631" size="10" pos="56" value="080a057fbe2b01f035cf"/>
    </field>
    <field name="hexdata" value="06b8ff7471fc732f62439c3f8018602863c300000101080a057fbe2b01f035cf"/>
  </proto>
  <proto name="tpkt" showname="TPKT" size="4" pos="66">
    <field name="tpkt.version" showname="Version: 3" size="1" pos="66" show="3" value="03"/>
    <field name="tpkt.reserved" showname="Reserved: 0" size="1" pos="67" show="0" value="00"/>
    <field name="tpkt.length" showname="Length: 76" size="2" pos="68" show="76" value="004c"/>
    <field name="hexdata" value="0300004c"/>
  </proto>
  <proto name="q931" showname="Q.931" size="72" pos="70">
    <field name="q931.disc" showname="Protocol discriminator: Q.931" size="1" pos="70" show="0x08" value="08"/>
    <field name="q931.call_ref_len" showname="Call reference value length: 2" size="1" pos="71" show="2" value="02"/>
    <field name="q931.call_ref_flag" showname="Call reference flag: Message sent to originating side" size="1" pos="72" show="1" value="9c"/>
    <field name="q931.call_ref" showname="Call reference value: 1C8A" size="2" pos="72" show="1c:8a" value="9c8a"/>
    <field name="q931.message_type" showname="Message type: CALL PROCEEDING (0x02)" size="1" pos="74" show="0x02" value="02"/>
    <field show="User-user" size="67" pos="75" value="7e0040052180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa30100010010800100">
      <field show="Information element: User-user" size="1" pos="75" value="7e"/>
      <field show="Length: 64" size="2" pos="76" value="0040"/>
      <field show="Protocol discriminator: X.208 and X.209 coded user information" size="1" pos="78" value="05"/>
    </field>
    <field name="hexdata" value="08029c8a027e0040052180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa30100010010800100"/>
  </proto>
  <proto name="h225" showname="H.225.0 CS" size="63" pos="79">
    <field name="h225.H323_UserInformation" showname="H323_UserInformation" size="63" pos="79" show="8:91:4a:00:04:28:c0:0b:0b:00:0b:06:53:75:72:70:61:73:73:06:53:69:65:6d:65:6e:73:40:01:38:08:86:00:11:00:40:53:b1:24:86:9c:d6:11:80:0c:00:20:af:6f:1a:a3:01:00:01:00:10:80:01:00" value="2180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa30100010010800100">
      <field name="per.extension_bit" showname="Extension Bit: 0... .... False" size="1" pos="79" show="0" value="21"/>
      <field name="per.optional_field_bit" showname="Optional Field Bit: .0.. .... False (user_data is NOT present)" size="1" pos="79" show="0" value="21"/>
      <field name="h225.H323_UU_PDU" showname="H323_UU_PDU" size="63" pos="79" show="0:06:00:08:91:4a:00:04:28:c0:0b:0b:00:0b:06:53:75:72:70:61:73:73:06:53:69:65:6d:65:6e:73:40:01:38:08:86:00:11:00:40:53:b1:24:86:9c:d6:11:80:0c:00:20:af:6f:1a:a3:01:00:01:00:10:80:01:00" value="2180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa30100010010800100">
        <field name="per.extension_bit" showname="Extension Bit: ..1. .... True" size="1" pos="79" show="1" value="21"/>
        <field name="per.optional_field_bit" showname="Optional Field Bit: ...0 .... False (nonStandardData is NOT present)" size="1" pos="79" show="0" value="21"/>
        <field show="h323_message_body" size="59" pos="79" value="2180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa301000100">
          <field name="per.extension_bit" showname="Extension Bit: .... 0... False" size="1" pos="79" show="0" value="21"/>
          <field name="h225.h323_message_body" showname="h323_message_body: .... .001 : callProceeding (1)" size="59" pos="79" show="1" value="2180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa301000100">
            <field name="h225.CallProceedingUUIE" showname="CallProceedingUUIE" size="58" pos="80" show=":91:4a:00:04:28:c0:0b:0b:00:0b:06:53:75:72:70:61:73:73:06:53:69:65:6d:65:6e:73:40:01:38:08:86:00:11:00:40:53:b1:24:86:9c:d6:11:80:0c:00:20:af:6f:1a:a3:01:00:01:00" value="80060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa301000100">
              <field name="per.extension_bit" showname="Extension Bit: 1... .... True" size="1" pos="80" show="1" value="80"/>
              <field name="per.optional_field_bit" showname="Optional Field Bit: .0.. .... False (h245Address is NOT present)" size="1" pos="80" show="0" value="80"/>
              <field name="per.object_length" showname="Object Length: 6" size="1" pos="81" show="6" value="06"/>
              <field name="h225.ProtocolIdentifier" showname="ProtocolIdentifier: 0.0.8.2250.0.4" size="6" pos="82" show="0.0.8.2250.0.4" value="0008914a0004"/>
              <field name="h225.destinationInfo" showname="destinationInfo" size="25" pos="88" show=":0b:00:0b:06:53:75:72:70:61:73:73:06:53:69:65:6d:65:6e:73:40:01:38" value="28c00b0b000b0653757270617373065369656d656e73400138">
                <field name="per.extension_bit" showname="Extension Bit: 0... .... False" size="1" pos="88" show="0" value="28"/>
                <field name="per.optional_field_bit" showname="Optional Field Bit: .0.. .... False (nonStandardData is NOT present)" size="1" pos="88" show="0" value="28"/>
                <field name="per.optional_field_bit" showname="Optional Field Bit: ..1. .... True (vendor is present)" size="1" pos="88" show="1" value="28"/>
                <field name="per.optional_field_bit" showname="Optional Field Bit: ...0 .... False (gatekeeper is NOT present)" size="1" pos="88" show="0" value="28"/>
                <field name="per.optional_field_bit" showname="Optional Field Bit: .... 1... True (gateway is present)" size="1" pos="88" show="1" value="28"/>
                <field name="per.optional_field_bit" showname="Optional Field Bit: .... .0.. False (mcu is NOT present)" size="1" pos="88" show="0" value="28"/>
                <field name="per.optional_field_bit" showname="Optional Field Bit: .... ..0. False (terminal is NOT present)" size="1" pos="88" show="0" value="28"/>
                <field name="h225.VendorIdentifier" showname="VendorIdentifier" size="22" pos="88" show="0b:00:0b:06:53:75:72:70:61:73:73:06:53:69:65:6d:65:6e:73" value="28c00b0b000b0653757270617373065369656d656e73">
                  <field name="per.extension_bit" showname="Extension Bit: .... ...0 False" size="1" pos="88" show="0" value="28"/>
                  <field name="per.optional_field_bit" showname="Optional Field Bit: 1... .... True (productId is present)" size="1" pos="89" show="1" value="c0"/>
                  <field name="per.optional_field_bit" showname="Optional Field Bit: .1.. .... True (versionId is present)" size="1" pos="89" show="1" value="c0"/>
                  <field name="h225.h221NonStandard" showname="h221NonStandard" size="5" pos="89" show="00:0b" value="c00b0b000b">
                    <field name="per.extension_bit" showname="Extension Bit: ..0. .... False" size="1" pos="89" show="0" value="c0"/>
                    <field name="h225.t35CountryCode" showname="t35CountryCode: Bahamas (11)" size="1" pos="90" show="11" value="0b"/>
                    <field name="h225.t35Extension" showname="t35Extension: 11" size="1" pos="91" show="11" value="0b"/>
                    <field name="h225.manufacturerCode" showname="manufacturerCode: 11" size="2" pos="92" show="11" value="000b"/>
                  </field>
                  <field name="per.octet_string_length" showname="Octet String Length: 7" size="1" pos="94" show="7" value="06"/>
                  <field name="h225.productID" showname="productID: Surpass" size="7" pos="95" show="Surpass" value="53757270617373"/>
                  <field name="per.octet_string_length" showname="Octet String Length: 7" size="1" pos="102" show="7" value="06"/>
                  <field name="h225.versionID" showname="versionID: Siemens" size="7" pos="103" show="Siemens" value="5369656d656e73"/>
                </field>
                <field name="h225.GatewayInfo" showname="GatewayInfo" size="2" pos="110" show="1" value="4001">
                  <field name="per.extension_bit" showname="Extension Bit: 0... .... False" size="1" pos="110" show="0" value="40"/>
                  <field name="per.optional_field_bit" showname="Optional Field Bit: .1.. .... True (protocol is present)" size="1" pos="110" show="1" value="40"/>
                  <field name="per.optional_field_bit" showname="Optional Field Bit: ..0. .... False (nonStandardData is NOT present)" size="1" pos="110" show="0" value="40"/>
                  <field name="h225.protocol" showname="protocol" size="2" pos="110" show="0:01" value="4001">
                    <field name="per.sequence_of_length" showname="Sequence-Of Length: 1" size="1" pos="111" show="1" value="01"/>
                    <field show="Item 0" size="1" pos="112" value="38">
                      <field show="SupportedProtocols" size="1" pos="112" value="38">
                        <field name="per.extension_bit" showname="Extension Bit: 0... .... False" size="1" pos="112" show="0" value="38"/>
                        <field name="h225.SupportedProtocols" showname="SupportedProtocols: .011 1... : voice (7)" size="1" pos="112" show="7" value="38">
                          <field name="h225.VoiceCaps" showname="VoiceCaps" size="1" pos="112" show="" value="38">
                            <field name="per.extension_bit" showname="Extension Bit: .... .0.. False" size="1" pos="112" show="0" value="38"/>
                            <field name="per.optional_field_bit" showname="Optional Field Bit: .... ..0. False (nonStandardData is NOT present)" size="1" pos="112" show="0" value="38"/>
                          </field>
                        </field>
                      </field>
                    </field>
                  </field>
                </field>
                <field name="h225.mc" showname="mc: .... ...0 False" size="1" pos="112" show="0" value="38"/>
                <field name="h225.undefinedNode" showname="undefinedNode: 0... .... False" size="1" pos="113" show="0" value="08"/>
              </field>
              <field name="per.small_number_bit" showname="Small Number Bit: .0.. .... False" size="1" pos="113" show="0" value="08"/>
              <field name="per.num_sequence_extensions" showname="Number of Sequence Extensions: 8" size="1" pos="113" show="8" value="08"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: 1... .... True (callIdentifier is present)" size="1" pos="114" show="1" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: .0.. .... False (h245SecurityMode is NOT present)" size="1" pos="114" show="0" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: ..0. .... False (tokens is NOT present)" size="1" pos="114" show="0" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: ...0 .... False (cryptoTokens is NOT present)" size="1" pos="114" show="0" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: .... 0... False (fastStart is NOT present)" size="1" pos="114" show="0" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: .... .1.. True (multipleCalls is present)" size="1" pos="114" show="1" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: .... ..1. True (maintainConnection is present)" size="1" pos="114" show="1" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: .... ...0 False (fastConnectRefused is NOT present)" size="1" pos="114" show="0" value="86"/>
              <field name="per.extension_present_bit" showname="Extension Present Bit: 0... .... False (featureSet is NOT present)" size="1" pos="115" show="0" value="00"/>
              <field name="per.open_type_length" showname="Open Type Length: 17" size="1" pos="116" show="17" value="11"/>
              <field name="h225.CallIdentifier" showname="CallIdentifier" size="17" pos="117" show="53:b1:24:86:9c:d6:11:80:0c:00:20:af:6f:1a:a3" value="004053b124869cd611800c0020af6f1aa3">
                <field name="per.extension_bit" showname="Extension Bit: 0... .... False" size="1" pos="117" show="0" value="00"/>
                <field name="h225.guid" showname="guid: 4053B124869CD611800C0020AF6F1AA3" size="16" pos="118" show="40:53:b1:24:86:9c:d6:11:80:0c:00:20:af:6f:1a:a3" value="4053b124869cd611800c0020af6f1aa3"/>
              </field>
              <field name="per.open_type_length" showname="Open Type Length: 1" size="1" pos="134" show="1" value="01"/>
              <field name="h225.multipleCalls" showname="multipleCalls: 0... .... False" size="1" pos="135" show="0" value="00"/>
              <field name="per.open_type_length" showname="Open Type Length: 1" size="1" pos="136" show="1" value="01"/>
              <field name="h225.maintainConnection" showname="maintainConnection: 0... .... False" size="1" pos="137" show="0" value="00"/>
            </field>
          </field>
        </field>
        <field name="per.small_number_bit" showname="Small Number Bit: 0... .... False" size="1" pos="138" show="0" value="10"/>
        <field name="per.num_sequence_extensions" showname="Number of Sequence Extensions: 8" size="1" pos="138" show="8" value="10"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: .... ...0 False (h4501SupplementaryService is NOT present)" size="1" pos="138" show="0" value="10"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: 1... .... True (h245Tunneling is present)" size="1" pos="139" show="1" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: .0.. .... False (h245Control is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: ..0. .... False (nonStandardControl is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: ...0 .... False (callLinkage is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: .... 0... False (tunnelledSignallingMessage is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: .... .0.. False (provisionalRespToH245Tunneling is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: .... ..0. False (stimulusControl is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.extension_present_bit" showname="Extension Present Bit: .... ...0 False (genericData is NOT present)" size="1" pos="139" show="0" value="80"/>
        <field name="per.open_type_length" showname="Open Type Length: 1" size="1" pos="140" show="1" value="01"/>
        <field name="h225.h245Tunneling" showname="h245Tunneling: 0... .... False" size="1" pos="141" show="0" value="00"/>
      </field>
    </field>
    <field name="hexdata" value="2180060008914a000428c00b0b000b0653757270617373065369656d656e7340013808860011004053b124869cd611800c0020af6f1aa30100010010800100"/>
  </proto>
</packet>