Wireshark · Wireshark-users: Re: [Wireshark-users] FW: [tcpdump-workers] Help on Ethernet Size

["Anders Broman" <a.broman@xxxxxxxxx>]

Hi,
Wireshark can already do that, take a look at the wiki page and
the VoIP protocol family page.
Best regards
Anders

-----Ursprungligt meddelande-----
Från: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För ARAMBULO, Norman R.
Skickat: den 7 mars 2007 06:50
Till: Tcpdump-Workers (E-mail); Wireshark-Users (E-mail);
Wireshark-users-request (E-mail); Tcpdump-Workers-Owner (E-mail)
Ämne: [Wireshark-users] FW: [tcpdump-workers] Help on Ethernet Size

Ok so it a lot of work, Can wireshark show the calling/called number
vice-versa?
I wanna sniff the calling/called numbers in our H323 voip calls..

So what language can you recommend using for such task? for Thanks

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 6 Mar 2007 18:31:46 -0800
On Mar 6, 2007, at 6:28 PM, ARAMBULO, Norman R. wrote:

Thanks for the enlightenment that helps a lot... Another 
thing how can I parse a voip call (h323 family, SIP, IAX etc.) Is 
wireshark capable of doing it.

Yes.

Can somebody send me a source code for parsing voip call in C language. 

http://www.wireshark.org/download/src/wireshark-0.99.5.tar.gz

:-)

Even if you strip out everything except the link-layer, IP, TCP, and SCTP 
dissectors, and the protocols running atop them in VoIP calls, and all the 
facilities in the Wireshark core that aren't needed to support those
dissectors, 
that's a *lot* of code. Dissecting packets isn't something you can do with a

quick little bit of C code.

Now, if by "parsing" you meant "constructing and sending, and receiving and 
processing" - i.e., you want to implement VoIP - there are other
free-software 
projects for that (Asterix, for example). However, for those, see the
previous 
paragraph; that's still a *lot* of code.

-----Original Message-----
From: tcpdump-workers-owner@xxxxxxxxxxxxxxxxx
[mailto:tcpdump-workers-owner@xxxxxxxxxxxxxxxxx]On Behalf Of Guy Harris
Sent: Wednesday, March 07, 2007 10:07 AM
To: Community support list for Wireshark
Cc: Tcpdump-Workers (E-mail)
Subject: Re: [tcpdump-workers] [Wireshark-users] Help on Ethernet Size


(the -request address for a mailing list is for requests to be added  
to or removed from a mailing list; it is not for messages sent to the  
list itself)

On Mar 6, 2007, at 5:36 PM, ARAMBULO, Norman R. wrote:
> Is the ethernet size always equal to 14 bytes?

The lowest-layer Ethernet header is always 14-bytes long - 6 bytes of  
destination address, 6 bytes of source address, and 2 bytes of type/ 
length field.  If the type/length field is > 1500 (or some number  
close to that - I forget the exact number, and the 802.3 spec has a  
range which is neither a valid type value nor a valid length value),  
it's a type field, and the value in it is the protocol running atop  
Ethernet (for example, hex 800 for IPv4).  If it's 1500 or less, it's  
a length field, and the Ethernet header is supposed to be followed by  
an IEEE 802.2 header (although Novell had a scheme in which it was  
immediately followed by an IPX header).
> and based on wireshark verbose is the frame part of the IP header?

What do you mean by "the frame"?

The packet details pane (by default, the bottommost pane) has, for an  
IPv4-over-Ethernet packet, a "Frame" protocol at the top, followed by  
an "Ethernet II" protocol, followed by an "IP" protocol.

"Frame" is not part of the packet data; it displays "metadata" such as  
the time stamp of the packet (which is *approximately* the time the  
packet arrived at the host that captured it), the total length of the  
packet data, and the number of bytes of packet data that were  
captured.  The "Ethernet II" protocol has the Ethernet header (14  
bytes), and the "IP" protocol has the IPv4 header.

Nothing in the "Frame" protocol comes from the packet data, so, in  
particular, it doesn't come from the IP header.
> Does wireshark insert = Protocols in frame: eth:ip:tcp:data or its  
> is part of the IP Header.

Wireshark inserts that.  It is *NOT* part of any packet data.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users