Ethereal-dev: Re: [Ethereal-dev] proposed q931 changes

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Tomas Kukosa <tomas.kukosa@xxxxxxxxxxx>
Date: Mon, 30 May 2005 09:37:12 +0200
Hi,

ad 1)
it can be implemented in a new dissector (called e.g. Cisco q931+) and registered to Q.931 IE table. Than it can be easily switched on/off.

Cvetan Ivanov wrote:
Hi,


This patch is not intended for addition to the source yet, I've just included it as illustration at this point. Would like to get some comments first.


What's changed:

1) added few more Cisco q931+ messages/IEs.
This leads to the question if dissecting q931+ should be made optional as those messages are invalid for normal q931, and marking them as unknow may be preferable if used with normal isdn trace
So should we have option for this?

2) fixed support for NFAS interfaces
The octet variable was overwritten in case that
 if (octet & Q931_INTERFACE_IDENTIFIED)
and then the next check fails and disecting the channel id is skipped

2.5) renamed Q931_NOT_BASIC_CHANNEL to Q931_NOT_BASIC_INTERFACE - the bit being called "Interface type"

3) Added basic dissecting of the channel ID in case its identified by number.

If it's bitmap the length depends on wether the interface is E1 or T1
So we could try to derive it from the total IE length (dissect as bytes to the end of the IE)?

Doing this I've also added the channel as protocol field, which may or may not have much sense - it can't be used to correlate call messages, but might be useful in other cases, like trying to identify faulty hardware

4) Interface ID:

as for the comment:

    * XXX - do we want to strip off the 8th bit on the
    * last octet of the interface identifier?

- we should. after all it's indicator bit, not part of the encoded data, but what's the correct way to do it:

- Interpret it as int, and add it as field, so we could flter on that?
- Just copy the bytes to a buffer and strip the bit, then add to the tree?

Any idea about how long that field is in real world implementations?
The Interface ID is too loosely defined in q931:

Interface identifier (octet 3.1)
Binary code assigned to the interface at subscription time. At subscription time, the binary code for the interface will specify the number of octets to be used and the content of each octet.


Best regards,

Cvetan