Ethereal-users: Re: [Ethereal-users] T.38 Decoding [please help me]

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Fri, 16 Jan 2004 06:59:09 +0100
Sudhakar Godithi:
>   I have recently started using the ethereal packet capture tool for t.38
> packets decoding.
>
>   I am able to decode the UDPTL Packets ( i.e packets through UDP),
>
>   but i am not able to configure this tool for IFP Packet Decoding( i.e
> packets through TCP).
>
>   Problem i am getting is Ethereal not recognising the TPKT Header present
> in the IFP,
>
>   Its treating TPKT as IFP starting and decoing the TPKT Header with T.38.


If you'll send some sample captures with T.38 IFP over TPKT over TCP I will
try to see if I can fix so that is supported.
Currently only T.38 IFP directly over TCP is supported.

I have made some changes to the T.38 dissector after the 0.10.0 relase and
noticed that TPKT header was recommended
according to latest versions of the specifications as I wrote in
http://www.ethereal.com/lists/ethereal-dev/200401/msg00085.html :

"PS! When I went through the T.38 specification I noticed that in the latest
version it is recommended to use T.38 IFP over TPKT over TCP,
when using TCP. Currently the T.38 dissector only supports T.38 IFP directly
over TCP and also doesn't handle TCP desegmentation.
I will try to look into that later, but I have only captures with T.38 UDPTL
over UDP (Pre-Corrigendum) and T.38 IFP directly
over TCP (Pre-Corrigendum and no segemented IFP packets). If there is
someone that has some nice T.38 captures I would be happy if you could send
them to me."


The T.38 documentation I looked in says:
"The IFP packets described in 7.2 are combined with the appropriate headers
for TCP/IP and UDP/IP as shown in Figures 4 and 5. In Figure 4, the UDPTL
header represents the additional header information required for error
control over UDP. To provide interoperability in H.323 environments, the
TPKT header defined in RFC1006 shall precede the IFP Packet in TCP
implementations as shown in Figure 4. Implementations using TPKT shall set
the version to 1 or higher.

Note: Implementations of T.38 with TCP/IP transport prior to version 1 were
not required to support the TPKT facility."