Ethereal-dev: Re: [Ethereal-dev] [patch] stun dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Mon, 17 Jan 2005 19:32:55 +0100
Jon Ringle wrote:
> On Monday 17 January 2005 11:25 am, martin.regner@xxxxxxxxx wrote:
> > Jon Ringle wrote:
> > > Yes. I am currently working on having rtp.version == 0 be dissected by
> > > stun. I'll be posting a patch soon.
> >
> > Please note that T.38 UDPTL packets may also appear as rtp.version==0
> > packets.
>
> I'm not familiar with T.38. I assume it gets negotiated via SDP? If so, can it
> be identified separately from RTP in the SDP?
>

... and I'm not so familiar with STUN (yet) so I don't know if there is something else that can be used except for
the version bits to differentiate between T.38 UDPTL and STUN.

Unfortunately there is often problem with T.38 being decoded as RTP
 since the same UDP port numbers are often used first for voice (RTP) then fax (T.38/UDPTL)
and maybe then voice (RTP) again in the same capture - and there is actually no good way of recognizing T.38/UDPTL,
but the bits corresponding to rtp.version is 0 for normal scnarios (except maybe for very long fax-sessions).

There is a sample RTP/T.38-UDPTL capture on the following page:
http://www.brooktrout.com/support/productinfo.cfm?frmProduct=TR1034&frmCategory=Knowledgebase&frmKnowBaseID=1983&Level=2