This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

LUA how to get multiple values from faststart items H225, H245

0

I want to get all media address and port form H323 call from faststart. Faststart filed only returns number of items in the message. If I do Field.new("h245.network") or Field.new("h245.tsapIdentifier") I got null result. How can I get to all of the items and display?

This is my code.

-- text_window_tap.lua
-- an example of a tap that registers a menu
-- and prints to a text window

instances = 0 – number of instances of the tap created so far

ip_addr_extractor = Field.new("ip.addr") tcp_port_extractor = Field.new("tcp.port") h225_faststart_extractor = Field.new("h225.fastStart") h225_guid_extractor = Field.new("h225.guid") h245_tsapidentifier_extractor = Field.new("h245.tsapIdentifier") h245_network_extractor = Field.new("h245.network")

function sip_tap_menu() instances = instances + 1

local td = {}

td.win = TextWindow.new("h225 SIGNALING PARSE " .. instances) – the window we'll use td.text = "" td.instance = instances – the instance number of this tap

– h225 SDP Processing local h225 = Listener.new("h225", "h225") – retap_packets() reload()

function h225.reset() end

function h225.packet(pinfo,tvb,userdata) local ip_src, ip_dst = ip_addr_extractor() local tcp_src, tcp_dst = tcp_port_extractor() local h225_faststart = h225_faststart_extractor() local h225_guid = h225_guid_extractor() local h245_tsapidentifier = h245_tsapidentifier_extractor() local h245_network = h245_network_extractor()

if h225_faststart then td.win:append( "faststart=" .. tostring(h225_faststart) ..
":IP_SRC=" .. tostring(ip_src) .. ":UDP_SRC=" .. tostring(tcp_src) .. ":IP_DST=" .. tostring(ip_dst) .. ":UDP_DST=" .. tostring(tcp_dst) .. ":h225_guid=" .. tostring(h225_guid) .. ":h245_tsapidentifier=" .. tostring(h245_tsapidentifier) .. ":h245_network=" .. tostring(h245_network) .. "\n") end

end

function remove_tap() if h225 and h225.remove then h225:remove() end end

td.win:set_atclose(remove_tap)

end register_menu("h225 Signaling Parse",sip_tap_menu,MENU_TOOLS_UNSORTED)

Sample capture of packet

H.225.0 CS
H323-UserInformation
h323-uu-pdu
h323-message-body: alerting (3)
alerting
protocolIdentifier: 0.0.8.2250.0.4 (Version 4)
destinationInfo
vendor
vendor
t35CountryCode: United States (181)
t35Extension: 0
manufacturerCode: 23
H.221 Manufacturer: VocalTec Communications, Inc. (0xb5000017)
versionId: 1.00
gateway
terminal
…. .0.. mc: False
…. ..0. undefinedNode: False
callIdentifier
guid: e0f238a4-d056-11df-b14e-0015173704f0
fastStart: 2 items
Item 0
FastStart item: 22 octets
OpenLogicalChannel
forwardLogicalChannelNumber: 129
forwardLogicalChannelParameters
dataType: nullData (1)
nullData: NULL
multiplexParameters: none (4)
none: NULL
reverseLogicalChannelParameters
dataType: audioData (3)
audioData: g729 (10)
g729: 2
multiplexParameters: h2250LogicalChannelParameters (2)
h2250LogicalChannelParameters
sessionID: 1
mediaControlChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: 81.15.5.10 (81.15.5.10)
tsapIdentifier: 10027
Item 1
FastStart item: 25 octets
OpenLogicalChannel
forwardLogicalChannelNumber: 4
forwardLogicalChannelParameters
dataType: audioData (3)
audioData: g729 (10)
g729: 2
multiplexParameters: h2250LogicalChannelParameters (3)
h2250LogicalChannelParameters
sessionID: 1
mediaChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: 81.15.5.10 (81.15.5.10)
tsapIdentifier: 10026
mediaControlChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: 81.15.5.10 (81.15.5.10)
tsapIdentifier: 10027
0… …. multipleCalls: False
1… …. maintainConnection: True
presentationIndicator: presentationAllowed (0)
presentationAllowed: NULL
screeningIndicator: userProvidedVerifiedAndFailed (2)
0… …. h245Tunnelling: False

asked 25 May ‘11, 01:40

jakan's gravatar image

jakan
1112
accept rate: 0%

edited 25 May ‘11, 01:50


One Answer:

1

That question seems to be showing up quite often

Quick lua search on this site

fetching-multiple-named-values-with-lua

And another example for different protocol

in your case something like below might work

my_h245_table = { h245_network_extractor() }
tostring(my_h245_table[0])..tostring(my_h245_table[1])

answered 25 May '11, 13:29

izopizo's gravatar image

izopizo
2024714
accept rate: 0%

It is not working. Now I tried with FastStart item: <h225.faststart_item> and it works. I got value 22 and 25 for both items. If I want to extract any other one there is nothing in the list. It looks like it is only working on first level items because I also tried with forwardLogicalChannelNumber: <h245.forwardlogicalchannelnumber> to and it is not working.

(26 May '11, 01:31) jakan