This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Decode packets as T.30 messages in wireshark

0

I need to decode a pcap file as T.30 using wireshark. In supported formats, wireshark has listed T.30. So it should be possible to decode the packets as T.30 messages. Could anybody please help me out how?

asked 26 Jun '13, 23:31

narasimha's gravatar image

narasimha
1●1●1●1
accept rate: 0%

edited 27 Jun '13, 13:38

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196

In supported formats, wireshark has listed T.30. So it should be possible to decode the packets as T.30 messages.

No, the first of those statements does not imply the second. Wireshark only supports T.30 messages when encapsulated in T.38 fax-over-IP packets. Does your pcap file contain regular networking traffic, including T.38, or does it contain some form of raw T.30 messages?

(27 Jun '13, 13:41) Guy Harris ♦♦

My pcap has only T30 fax messages.. Could you tell me how to decode the T30 messages when its encapsulated in T.38 fax-over-IP packets?

(01 Jul '13, 23:57) narasimha

Are those:

  • T.30 messages with no encapsulation;
  • T.30 encapsulated in T.38;
  • T.30 encapsulated in T.38 encapsulated in TPKT/TCP;
  • T.30 encapsulated in T.38 encapsulated in TPKT/TCP encapsulated in IP;
  • T.30 encapsulated in T.38 encapsulated in TPKT/TCP encapsulated in IP encapsulated in some link layer (Ethernet, 802.11, etc.);
  • something else?
(02 Jul '13, 00:23) Guy Harris ♦♦

T.30 messages encapsulated in UDP..

(02 Jul '13, 01:23) narasimha

sorry. those t30 messages are sent in an rtp stream. And i need to decode those..

(02 Jul '13, 01:25) narasimha