I want to get all media address and port form H323 call from faststart. Faststart filed only returns number of items in the message. If I do Field.new("h245.network") or Field.new("h245.tsapIdentifier") I got null result. How can I get to all of the items and display?
This is my code.
-- text_window_tap.lua
-- an example of a tap that registers a menu
-- and prints to a text window
instances = 0 – number of instances of the tap created so far
ip_addr_extractor = Field.new("ip.addr")
tcp_port_extractor = Field.new("tcp.port")
h225_faststart_extractor = Field.new("h225.fastStart")
h225_guid_extractor = Field.new("h225.guid")
h245_tsapidentifier_extractor = Field.new("h245.tsapIdentifier")
h245_network_extractor = Field.new("h245.network")
function sip_tap_menu()
instances = instances + 1
local td = {}
td.win = TextWindow.new("h225 SIGNALING PARSE " .. instances) – the window we'll use
td.text = ""
td.instance = instances – the instance number of this tap
– h225 SDP Processing
local h225 = Listener.new("h225", "h225")
– retap_packets()
reload()
function h225.reset()
end
function h225.packet(pinfo,tvb,userdata)
local ip_src, ip_dst = ip_addr_extractor()
local tcp_src, tcp_dst = tcp_port_extractor()
local h225_faststart = h225_faststart_extractor()
local h225_guid = h225_guid_extractor()
local h245_tsapidentifier = h245_tsapidentifier_extractor()
local h245_network = h245_network_extractor()
if h225_faststart then
td.win:append( "faststart=" .. tostring(h225_faststart) ..
":IP_SRC=" .. tostring(ip_src) ..
":UDP_SRC=" .. tostring(tcp_src) ..
":IP_DST=" .. tostring(ip_dst) ..
":UDP_DST=" .. tostring(tcp_dst) ..
":h225_guid=" .. tostring(h225_guid) ..
":h245_tsapidentifier=" ..
tostring(h245_tsapidentifier) ..
":h245_network=" .. tostring(h245_network) .. "\n")
end
end
function remove_tap()
if h225 and h225.remove then
h225:remove()
end
end
td.win:set_atclose(remove_tap)
end
register_menu("h225 Signaling Parse",sip_tap_menu,MENU_TOOLS_UNSORTED)
Sample capture of packet
H.225.0 CS
H323-UserInformation
h323-uu-pdu
h323-message-body: alerting (3)
alerting
protocolIdentifier: 0.0.8.2250.0.4 (Version 4)
destinationInfo
vendor
vendor
t35CountryCode: United States (181)
t35Extension: 0
manufacturerCode: 23
H.221 Manufacturer: VocalTec Communications, Inc. (0xb5000017)
versionId: 1.00
gateway
terminal
…. .0.. mc: False
…. ..0. undefinedNode: False
callIdentifier
guid: e0f238a4-d056-11df-b14e-0015173704f0
fastStart: 2 items
Item 0
FastStart item: 22 octets
OpenLogicalChannel
forwardLogicalChannelNumber: 129
forwardLogicalChannelParameters
dataType: nullData (1)
nullData: NULL
multiplexParameters: none (4)
none: NULL
reverseLogicalChannelParameters
dataType: audioData (3)
audioData: g729 (10)
g729: 2
multiplexParameters: h2250LogicalChannelParameters (2)
h2250LogicalChannelParameters
sessionID: 1
mediaControlChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: 81.15.5.10 (81.15.5.10)
tsapIdentifier: 10027
Item 1
FastStart item: 25 octets
OpenLogicalChannel
forwardLogicalChannelNumber: 4
forwardLogicalChannelParameters
dataType: audioData (3)
audioData: g729 (10)
g729: 2
multiplexParameters: h2250LogicalChannelParameters (3)
h2250LogicalChannelParameters
sessionID: 1
mediaChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: 81.15.5.10 (81.15.5.10)
tsapIdentifier: 10026
mediaControlChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: 81.15.5.10 (81.15.5.10)
tsapIdentifier: 10027
0… …. multipleCalls: False
1… …. maintainConnection: True
presentationIndicator: presentationAllowed (0)
presentationAllowed: NULL
screeningIndicator: userProvidedVerifiedAndFailed (2)
0… …. h245Tunnelling: False
asked 25 May ‘11, 01:40
jakan
1●1●1●2
accept rate: 0%
It is not working. Now I tried with FastStart item: <h225.faststart_item> and it works. I got value 22 and 25 for both items. If I want to extract any other one there is nothing in the list. It looks like it is only working on first level items because I also tried with forwardLogicalChannelNumber: <h245.forwardlogicalchannelnumber> to and it is not working.