This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I want to get all media address and port form H323 call from faststart. Faststart filed only returns number of items in the message. If I do Field.new("h245.network") or Field.new("h245.tsapIdentifier") I got null result. How can I get to all of the items and display?

This is my code.


-- text_window_tap.lua
-- an example of a tap that registers a menu
-- and prints to a text window

instances = 0 -- number of instances of the tap created so far

ip_addr_extractor = Field.new("ip.addr")
tcp_port_extractor = Field.new("tcp.port")
h225_faststart_extractor = Field.new("h225.fastStart")
h225_guid_extractor = Field.new("h225.guid")
h245_tsapidentifier_extractor = Field.new("h245.tsapIdentifier")
h245_network_extractor = Field.new("h245.network")

function sip_tap_menu()
    instances = instances + 1

local td = {}

td.win = TextWindow.new("h225 SIGNALING PARSE " .. instances) -- the window we'll use
    td.text = ""
    td.instance = instances -- the instance number of this tap

-- h225 SDP Processing
    local h225 = Listener.new("h225", "h225")
    -- retap_packets()
    reload()

function h225.reset()
    end

function h225.packet(pinfo,tvb,userdata)
       local ip_src, ip_dst = ip_addr_extractor()
       local tcp_src, tcp_dst = tcp_port_extractor()
       local h225_faststart = h225_faststart_extractor()
       local h225_guid = h225_guid_extractor()
       local h245_tsapidentifier = h245_tsapidentifier_extractor()
       local h245_network = h245_network_extractor()

if h225_faststart then
           td.win:append( "faststart=" ..  tostring(h225_faststart) ..  
           ":IP_SRC=" ..  tostring(ip_src) .. 
           ":UDP_SRC=" .. tostring(tcp_src) .. 
           ":IP_DST=" .. tostring(ip_dst) .. 
           ":UDP_DST=" .. tostring(tcp_dst) .. 
           ":h225_guid=" .. tostring(h225_guid) .. 
           ":h245_tsapidentifier=" .. 
           tostring(h245_tsapidentifier)  .. 
           ":h245_network=" .. tostring(h245_network) .. "\n")
       end

end

function remove_tap()
        if h225 and h225.remove then
            h225:remove()
        end
    end

td.win:set_atclose(remove_tap)

end
register_menu("h225 Signaling Parse",sip_tap_menu,MENU_TOOLS_UNSORTED)

Sample capture of packet


H.225.0 CS
    H323-UserInformation
        h323-uu-pdu
            h323-message-body: alerting (3)
                alerting
                    protocolIdentifier: 0.0.8.2250.0.4 (Version 4)
                    destinationInfo
                        vendor
                            vendor
                                t35CountryCode: United States (181)
                                t35Extension: 0
                                manufacturerCode: 23
                            H.221 Manufacturer: VocalTec Communications, Inc. (0xb5000017)
                            versionId: 1.00
                        gateway
                        terminal
                        .... .0.. mc: False
                        .... ..0. undefinedNode: False
                    callIdentifier
                        guid: e0f238a4-d056-11df-b14e-0015173704f0
                    fastStart: 2 items
                        Item 0
                            FastStart item: 22 octets
                            OpenLogicalChannel
                                forwardLogicalChannelNumber: 129
                                forwardLogicalChannelParameters
                                    dataType: nullData (1)
                                        nullData: NULL
                                    multiplexParameters: none (4)
                                        none: NULL
                                reverseLogicalChannelParameters
                                    dataType: audioData (3)
                                        audioData: g729 (10)
                                            g729: 2
                                    multiplexParameters: h2250LogicalChannelParameters (2)
                                        h2250LogicalChannelParameters
                                            sessionID: 1
                                            mediaControlChannel: unicastAddress (0)
                                                unicastAddress: iPAddress (0)
                                                    iPAddress
                                                        network: 81.15.5.10 (81.15.5.10)
                                                        tsapIdentifier: 10027
                        Item 1
                            FastStart item: 25 octets
                            OpenLogicalChannel
                                forwardLogicalChannelNumber: 4
                                forwardLogicalChannelParameters
                                    dataType: audioData (3)
                                        audioData: g729 (10)
                                            g729: 2
                                    multiplexParameters: h2250LogicalChannelParameters (3)
                                        h2250LogicalChannelParameters
                                            sessionID: 1
                                            mediaChannel: unicastAddress (0)
                                                unicastAddress: iPAddress (0)
                                                    iPAddress
                                                        network: 81.15.5.10 (81.15.5.10)
                                                        tsapIdentifier: 10026
                                            mediaControlChannel: unicastAddress (0)
                                                unicastAddress: iPAddress (0)
                                                    iPAddress
                                                        network: 81.15.5.10 (81.15.5.10)
                                                        tsapIdentifier: 10027
                    0... .... multipleCalls: False
                    1... .... maintainConnection: True
                    presentationIndicator: presentationAllowed (0)
                        presentationAllowed: NULL
                    screeningIndicator: userProvidedVerifiedAndFailed (2)
            0... .... h245Tunnelling: False

asked 25 May '11, 01:40

jakan's gravatar image

jakan
1112
accept rate: 0%

edited 25 May '11, 01:50


That question seems to be showing up quite often

Quick lua search on this site

fetching-multiple-named-values-with-lua

And another example for different protocol

in your case something like below might work

my_h245_table = { h245_network_extractor() }
tostring(my_h245_table[0])..tostring(my_h245_table[1])
permanent link

answered 25 May '11, 13:29

izopizo's gravatar image

izopizo
2024714
accept rate: 0%

It is not working. Now I tried with FastStart item: <h225.faststart_item> and it works. I got value 22 and 25 for both items. If I want to extract any other one there is nothing in the list. It looks like it is only working on first level items because I also tried with forwardLogicalChannelNumber: <h245.forwardlogicalchannelnumber> to and it is not working.

(26 May '11, 01:31) jakan
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431
×11
×6
×4

question asked: 25 May '11, 01:40

question was seen: 3,927 times

last updated: 26 May '11, 01:31

p​o​w​e​r​e​d by O​S​Q​A