[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 19, 2003, at 10:47 AM, Paul Higgs (CA/EUS) wrote:

> I have found a problem with the dissector for H245 in regards to 
> displaying the signalType of a UserInputIndication. The signalType 
> prints as a ? when it is actually an !
>
> H.225.0 CS
>     H323_UserInformation
>         H323_UU_PDU
>             h323_message_body
>                 h323_message_body: .... .110 : facility (6)
>                     FacilityUUIE
>                         ProtocolIdentifier: 0.0.8.2250.0.4
>                         FacilityReason
>                             transportedInformation
>                         CallIdentifier
>                             guid: 2AFA51A97C0000102143204166275475
>                         multipleCalls: 0... .... False
>                         maintainConnection: 0... .... False
>             h245Tunneling: 1... .... True
>             h245Control
>                 Item 0
>                     Octet String Length: 7
>                     H.245
>                         MultimediaSystemControlMessage
>                             PDU Type: .11. .... : Indication (3)
>                                 IndicationMessage
>                                     Indication Type: .... 1101 : 
> UserInputIndication (13)
>                                         UserInputIndication
>                                             signal
>                                                 
> UserInputIndication_signal
>                                                     signalType: ?
>                                                     duration: 400
>
> 0000  00 80 37 84 fb 9c 00 10 b5 75 ac 1d 08 00 45 00   
> ..7......u....E.
> 0010  00 6a bb 17 40 00 80 06 93 e7 c0 a8 15 32 c0 a8   
> .j..@........2..
> 0020  15 0c 75 5a 0f a1 e5 77 18 df 95 c4 e6 f4 50 18   
> ..uZ...w......P.
> 0030  43 3a b0 d2 00 00 03 00 00 42 08 02 12 76 62 1c   
> C:.......B...vb.
> 0040  00 7e 00 34 05 26 80 06 00 08 91 4a 00 04 86 01   
> .~.4.&.....J....
> 0050  00 1f 01 80 11 00 2a fa 51 a9 7c 00 00 10 21 43   
> ......*.Q.|...!C
> 0060  20 41 66 27 54 75 01 00 01 00 10 c0 01 80 09 01    
> Af'Tu..........
> 0070  07 6d 81 04 44 20 01 8f                           .m..D ..
>
> I looked in the codebase and it seems that this element is not 
> dissceted as an IA5string but with some other method.

It's dissected as a restricted character string - but the set of 
characters in that string includes "!".

What does the H.245 spec say that element is?  And, if it's a 
restricted character string:

	1) what's the alphabet for it?

	2) what's the numerical value of the first (and only) character in it)?

According to

	http://www.packetizer.com/iptel/h245/h245_asn.html

the ASN.1 for it is

	signalType
                IA5String(SIZE (1) ^ FROM ("0123456789#*ABCD!")),

but the alphabet string passed to 
"dissect_per_restricted_character_string()" is "!#*0123456789ABCD".