Ethereal-dev: [Ethereal-dev] [PATCH] T.38 dissector improvements

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Mon, 5 Jan 2004 18:12:24 +0100
Hi,

In some scenarios for a T.38 fax call there is first a voice call setup
(RTP) and then switching to T.38 UDPTL.
The RTP packets and T.38 UDPTL packets may then be sent on the same UDP port
numbers.
Ethereal starts up a conversation for RTP if it can see the H.245/SDP
signalling, and then the T.38 UDPTL packets may be shown as RTP packets with
"unknown version: 0".
Even if you try to use "Decode As..." T.38 the packets are still shown as
RTP packets since conversations has the highest
priority.
This problem has been reported in the following message:
http://www.ethereal.com/lists/ethereal-users/200312/msg00142.html

A temporar solution can be to use a display filter "rtp.version == 0" and
save just those packets in a new file, and use "Decode As.."
after loading in that file. However it would be nice to solve this problem
in a better way.

There can also be similar problems even if a conversation is not setup for
RTP (e.g. no H.245/SDP signalling in the capture file).
If you mark one RTP packet and select "Decode As..." also the T.38 packets
will be shown as RTP packets since its the same port number, and opposite if
you mark a T.38 packet and use "Decode As..." you will get the RTP packets
decoded as T.38 packets (many of them will be shown as "Malformed").

I have tried to solve these problem with the attached patches and also added
some other improvements to the T.38 dissector.

1)
I have added a new preference setting for RTP dissector that can be used to
make RTP dissector reject packets
that doesn't have the RTP version field set to 2. The default behaviour is
that RTP dissector will dissect all packets independently
of the version. For T.38 UDPTL packets the bits coresponding to the "RTP
version" will in normal cases be zero since UDPTL sequence numbers should
start
from 0 according to T.38 specification. I guess that there needs to be a
very long fax session in order to get sequence numbers
above 32767 (a lot of  fax-pages during one fax call). I haven't seen that
in any captures I have looked at.

2)
I also needed to do some small changes in epan/conversation.c and
epan/packet.h so that Ethereal will continue with other dissectors if the
conversation dissector rejects the packet.

3)
I also added a preference setting in T.38 dissector to dissect packet with
the RTP dissector if the packet looks like an RTP version 2 packet.
This can be handy for the scenario where no conversation has been started.
You select one of the UDP packets and  select "Decode As..."
T.38, and the packets for that port number will be dissected with RTP or
T.38 dissector dependant on if the packet looks like an RTP
packet or not. The default setting is that packets will be dissected as T.38
packets.

4)
I have also added two preference settings in T.38 disector for the UDP and
TCP port numbers.

5)
The T.38 dissector will now give a summary of the T.38 packet (just for the
primary part, not the redundancy data) in the Info-column, see attached
printout example.

6)
I have added a preference setting whether to use the Pre-Corrigendum T.38
ASN.1 specification (1998) or the Corrigendum (2001).
These ASN.1 specifications are uncompatible and there is equipment that uses
either of these specifications (openh323 can be configured to use either of
these).
http://www.openh323.org/pipermail/t38/2002-September/000112.html
http://lists.cs.columbia.edu/pipermail/sip-implementors/2003-March/004619.ht
ml


PS! When I went through the T.38 specification I noticed that in the latest
version it is recommended to use T.38 IFP over TPKT over TCP,
when using TCP. Currently the T.38 dissector only supports T.38 IFP directly
over TCP and also doesn't handle TCP desegmentation.
I will try to look into that later, but I have only captures with T.38 UDPTL
over UDP (Pre-Corrigendum) and T.38 IFP directly
over TCP (Pre-Corrigendum and no segemented IFP packets). If there is
someone that has some nice T.38 captures I would be happy if you could send
them to me.

Attachment: conversation.c.patch
Description: Binary data

Attachment: packet-rtp.c.patch
Description: Binary data

    916 13.254087   10.10.10.1           16558  10.10.10.8           19530  RTP      74     Payload type=ITU-T G.729, SSRC=261555009, Seq=620, Time=2780835868
    917 13.257526   10.10.10.8           19530  10.10.10.1           16558  RTP      60     Payload type=ITU-T G.729, SSRC=254477122, Seq=3797, Time=4274218803
    918 13.273893   10.10.10.1           16558  10.10.10.8           19530  RTP      74     Payload type=ITU-T G.729, SSRC=261555009, Seq=621, Time=2780836028
    919 13.292783   10.10.10.1           1720   10.10.10.8           11028  H.245    128    CS: empty RequestMode 
    920 13.293534   10.10.10.1           16558  10.10.10.8           19530  RTP      74     Payload type=ITU-T G.729, SSRC=261555009, Seq=622, Time=2780836188
    921 13.297494   10.10.10.8           19530  10.10.10.1           16558  RTP      60     Payload type=ITU-T G.729, SSRC=254477122, Seq=3798, Time=4274219123
    922 13.313255   10.10.10.8           11028  10.10.10.1           1720   H.245    105    CS: empty RequestModeAck 
    923 13.313717   10.10.10.1           16558  10.10.10.8           19530  RTP      74     Payload type=ITU-T G.729, SSRC=261555009, Seq=623, Time=2780836348
    924 13.318145   10.10.10.1           1720   10.10.10.8           11028  H.245    106    CS: empty CloseLogicalChannel 
    925 13.322309   10.10.10.1           16559  10.10.10.8           19531  RTCP     110    Receiver Report
    926 13.336521   10.10.10.8           11028  10.10.10.1           1720   H.245    192    CS: empty CloseLogicalChannel CS: empty OpenLogicalChannel (t38fax) 
    927 13.337263   10.10.10.8           19531  10.10.10.1           16559  RTCP     86     Receiver Report
    928 13.338207   10.10.10.1           1720   10.10.10.8           11028  H.245    140    CS: empty OpenLogicalChannel (t38fax) 
    929 13.339082   10.10.10.1                  10.10.10.8                  ICMP     70     Destination unreachable
    930 13.354683   10.10.10.8           11028  10.10.10.1           1720   H.245    105    CS: empty CloseLogicalChannelAck 
    931 13.356660   10.10.10.1           1720   10.10.10.8           11028  H.245    105    CS: empty CloseLogicalChannelAck 
    932 13.573928   10.10.10.8           11028  10.10.10.1           1720   H.245    128    CS: empty OpenLogicalChannelAck 
    933 13.575195   10.10.10.1           1720   10.10.10.8           11028  H.245    128    CS: empty OpenLogicalChannelAck 
    934 13.588137   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    935 13.594435   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    936 13.678090   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    937 13.684354   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    938 13.768062   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    939 13.774354   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    940 13.775821   10.10.10.8           11028  10.10.10.1           1720   TCP      60     11028 > 1720 [ACK] Seq=846 Ack=968 Win=3161 Len=0
    941 13.777983   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
    942 13.864547   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    943 13.868116   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
    944 13.954477   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    945 13.957936   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
    946 14.044458   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    947 14.047882   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
    948 14.134447   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    949 14.137891   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
    950 14.224429   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    951 14.227889   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
    952 14.308104   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00002  data:v21: hdlc-data[FF]
    953 14.314321   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    954 14.338110   10.10.10.1           16558  10.10.10.8           19530  T.38     62     UDP: UDPTLPacket Seq=00003  data:v21: hdlc-data[C0]
    955 14.358238   10.10.10.1           16558  10.10.10.8           19530  T.38     67     UDP: UDPTLPacket Seq=00004  data:v21: hdlc-data[04]
    956 14.388159   10.10.10.1           16558  10.10.10.8           19530  T.38     67     UDP: UDPTLPacket Seq=00005  data:v21: hdlc-data[B5]
    957 14.404728   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal
    958 14.418202   10.10.10.1           16558  10.10.10.8           19530  T.38     67     UDP: UDPTLPacket Seq=00006  data:v21: hdlc-data[00]
    959 14.438175   10.10.10.1           16558  10.10.10.8           19530  T.38     67     UDP: UDPTLPacket Seq=00007  data:v21: hdlc-data[8A]
    960 14.468172   10.10.10.1           16558  10.10.10.8           19530  T.38     67     UDP: UDPTLPacket Seq=00008  data:v21: hdlc-data[5A]
    961 14.494343   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00000  t30ind: no-signal




   1039 17.388011   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1040 17.424507   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
   1041 17.477965   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1042 17.514229   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00001  t30ind: v21-preamble
   1043 17.567977   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1044 17.604307   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00002  data:v21: hdlc-data[FF]
   1045 17.634463   10.10.10.8           19530  10.10.10.1           16558  T.38     62     UDP: UDPTLPacket Seq=00003  data:v21: hdlc-data[C8]
   1046 17.654467   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00004  data:v21: hdlc-data[C1]
   1047 17.657978   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1048 17.684451   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00005  data:v21: hdlc-data[00]
   1049 17.714370   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00006  data:v21: hdlc-data[60]
   1050 17.734323   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00007  data:v21: hdlc-data[11]
   1051 17.747851   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1052 17.764272   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00008  data:v21: hdlc-data[01]
   1053 17.794351   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00009  data:v21: hdlc-data[01]
   1054 17.814367   10.10.10.8           19530  10.10.10.1           16558  T.38     67     UDP: UDPTLPacket Seq=00010  data:v21: hdlc-data[00]
   1055 17.824283   10.10.10.8           19530  10.10.10.1           16558  T.38     64     UDP: UDPTLPacket Seq=00011  data:v21: hdlc-fcs-OK
   1056 17.837797   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1057 17.884471   10.10.10.8           19530  10.10.10.1           16558  T.38     61     UDP: UDPTLPacket Seq=00012  data:v21: hdlc-sig-end
   1058 17.894310   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00013  t30ind: no-signal
   1059 17.927873   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1060 17.934276   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00014  t30ind: v29-9600-training
   1061 18.017996   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1062 18.024240   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00014  t30ind: v29-9600-training
   1063 18.107909   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1064 18.114200   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00014  t30ind: v29-9600-training
   1065 18.154321   10.10.10.8           19530  10.10.10.1           16558  T.38     60     UDP: UDPTLPacket Seq=00015  data:v29-9600: t4-non-ecm-data[A5A5A5]
   1066 18.194530   10.10.10.8           19530  10.10.10.1           16558  T.38     120    UDP: UDPTLPacket Seq=00016  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1067 18.197809   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1068 18.234590   10.10.10.8           19530  10.10.10.1           16558  T.38     181    UDP: UDPTLPacket Seq=00017  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1069 18.274601   10.10.10.8           19530  10.10.10.1           16558  T.38     172    UDP: UDPTLPacket Seq=00018  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1070 18.287832   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1071 18.314628   10.10.10.8           19530  10.10.10.1           16558  T.38     172    UDP: UDPTLPacket Seq=00019  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1072 18.354668   10.10.10.8           19530  10.10.10.1           16558  T.38     172    UDP: UDPTLPacket Seq=00020  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1073 18.378106   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal
   1074 18.394753   10.10.10.8           19530  10.10.10.1           16558  T.38     172    UDP: UDPTLPacket Seq=00021  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1075 18.434729   10.10.10.8           19530  10.10.10.1           16558  T.38     172    UDP: UDPTLPacket Seq=00022  data:v29-9600: t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...] t4-non-ecm-data[A5A5A5A5A5A5A5...]
   1076 18.467919   10.10.10.1           16558  10.10.10.8           19530  T.38     60     UDP: UDPTLPacket Seq=00028  t30ind: no-signal

Attachment: packet.h.patch
Description: Binary data

Attachment: packet-t38.c.patch
Description: Binary data