Leonid Fainshtein wrote:
> How is it possible to get T.38 dissection? I tried rigth-click|"Decode
> as|..." on T.38 UDP packet but it doesn't work. Ethereal continues to
> dissect the packet as RTP packet. I'm running version 0.10.0 under WinXP.
My guess is that this is due to that there is something called
"conversation" setup internally in Ethereal (for RTP) that has higher
priority than using the port numbers to decide what dissector to call first.
The same port is probably used for both RTP and T.38/UDPTL in your case.
I think that I have seen something similar in some T.38/UDPTL captures I
have.
The RTP dissector doesn't currently reject packets that doesn't look like
RTP packets, so the
packets are probably shown as RTP packets with version 0 instead of T.38.
One temporar solution could be to disable RTP protocol temporarily.
Analyze/Enabled protocols.../RTP (mark RTP entry so it's shown as
Disabled, press Apply and OK).
The method I used was to select the packets that were faulty decoded (e.g.
RTP version 0) by using
a display filter (rtp.version == 0) and then save just the displayed packet
with Save As...
"Save only packets currently being displayed".
Then when reading in the file with just those packets I used
DecodeAs../T.38.
/Martin