Ethereal-users: Re: [Ethereal-users] problems with H225 decoding in Ethereal 0.9. 2

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 23 Jul 2002 13:23:32 -0700
On Tue, Jul 23, 2002 at 09:57:06AM +0200, Willemen Vaya wrote:
> The problem with the machine not showing any H225 at all is solved. It had
> something to do with the Ethernet card being an on-board card, which was no
> good as it turned out.

That means it's not a problem with *showing* H.225, it's a problem with
*capturing* H.225.

That's why I asked whether the *same* capture file shows different
decodes on *different* machines.

If there's a capture problem, the problem will depend on which machine
*captured* the traffic, and if you save the capture file and open it on
another machine, the same problem will show up.

If there's a decoding problem, the problem will depend on the machine on
which you're *looking at the packet*, and if you save the capture file
and open it on another machine, you may see different results.

> Still the problem with the "failure to decode"
> certain H225 messages persists. I took traces on both machines (the one with
> the problem and the one without) of a similar VoIP call. The two calls were
> made on the same system (i.e. same gatekeeper, same database, ...), just
> traced with different machines. On both machines, the same ethereal version
> is installed. I took screenshots of the plugin screen as you requested, and
> I also included the sniffs in the attachement.

The two traces are different, so it's not necessarily surprising that
they show different results.

The "failure" trace shows some failure report in the summary display.  I
have no idea what that's happening (I don't have the H.225 plugin
installed on any machine, and don't have source to it); you should ask
Andreas Sikkema about that.

What happens if you try to read the "failure" trace on the machine where
you took the "success" trace?  (I suspect it'll show the same errors,
meaning that it's almost certainly a capture problem.)