Hi Anders,
That's weird. I did a 'svn update', 'make clean' and 'make' but still got
the same result....
---------------------------------------------------------------------------
Version 0.10.13 (SVN 20051116202529) (C) 1998-2005 Gerald Combs <gerald@xxxxxxxxxxxx>
Compiled with GTK+ 2.6.10, with GLib 2.8.3, with libpcap 0.9.4, with libz 1.2.3,
without libpcre, without UCD-SNMP or Net-SNMP, without ADNS.
NOTE: this build doesn't support the "matches" operator for Ethereal filter
syntax.
Running with libpcap version 0.9.4 on Linux 2.4.27-2-386.
--------------------------------------------------------------------------
This is the detailed dissection as I got it, now and before.
--------------------------------------------------------------------------
Frame 1 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 00:11:85:15:68:7b (00:11:85:15:68:7b), Dst: 00:60:08:4d:38:b5 (00:60:08:4d:38:b5)
Internet Protocol, Src: 130.139.45.128 (130.139.45.128), Dst: 192.168.18.4 (192.168.18.4)
Transmission Control Protocol, Src Port: 2284 (2284), Dst Port: 2050 (2050), Seq: 0, Ack: 0, Len: 1460
TPKT, Version: 3, Length: 1799
Q.931
Protocol discriminator: Q.931
Call reference value length: 2
Call reference flag: Message sent from originating side
Call reference value: 588C
Message type: SETUP (0x05)
> Bearer capability
> Display 'frans\000'
> Called party number: '2003'
v User-user
Information element: User-user
Length: 1767
Protocol discriminator: X.208 and X.209 coded user information
[Packet size limited during capture: Q.931 truncated]
--------------------------------------------------------------------------
You can get the same result when you switch on the TCP option 'Validate
the TCP checksum if possible'. I wonder why this is?
Thanx,
Jaap
On Wed, 16 Nov 2005, Anders Broman wrote:
> Hi,
> It displays reassembled on the latest Ethereal SVN version, without any
> patch.
> Brg
> Anders
>
> -----Ursprungligt meddelande-----
> Fr?n: ethereal-dev-bounces@xxxxxxxxxxxx
> [mailto:ethereal-dev-bounces@xxxxxxxxxxxx] F?r Jaap Keuter
> Skickat: den 16 november 2005 17:55
> Till: Ethereal Developer Mailinglist
> ?mne: [Ethereal-dev] [PATCH] Q.931 fails to pass long message to H.225
>
> Hi list,
>
> Someone tossed me this capture which he expected to be reassembled. We
> checked all the reassemble check boxes on TCP, TPKT, Q.931 but to no
> avail. Searching through the code I came up with this oneliner, which
> does not accomplish reassembly, but does break the dissection less
> severly.
>
> Thanx,
> Jaap
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>