Hello Martin,
Martin Mathieson wrote:
The attached patches add 2 hidden display filters for SIP - namely:
(1) sip.error (for all responses with code >= 300)
(2) sip.resend (for all packets that appear to have been retransmitted). A
field showing a count of these is shown in the SIP stats window.
As in http I would only consider response codes greater than or equal to
400 as Errors.
These filters make it much easier to zero in on problems in large captures
(e.g. bulk call tests) evident from the SIP stats window.
(1) is straightforward, and needed because the response code is regarded as
a string, so its not easy to write your own expression
If you add the response code as an integer and not as an item to the
protocol tree, you can use value comparing expressions in the display
filter.
You should also make sure that the variable tree is not NULL before
calling any proto_tree_xxx function.
(2) is more involved, and I would like to hear from other SIP users about
this addition. Some notes:
- Only considers UDP packets
- Hash table contains (call_id, source_addr, dest_addr) -> (cseq,
simplified transaction_state).
An earlier version used proper conversations but the call-id is the most
important part of the key. Addresses are still needed for when e.g. more
than one leg of a proxied call is in the same capture.
- Size of hash table key and value memchunks (as number of elements) are
settable as a SIP property so as not to waste memory but to still allow
large values
ASAIK this value describes the initially allocated amount of memory for
this memchunk and not the maximum.
However nice work.
Regards,
Lars
