Itsik Alaluf
wrote:
<We are using
Ethereal
10.3 to analyze H.323 packet in our application,
<We have noticed
that in case Q.931 TCP packets are segmented by TCP
<into Short
frames the Ethereal doesn't analyze (and therefore doesn't
display)
<the Q.931 data
nor H.225/H.245 although these protocols are enabled
<(In the
Analyze menu) and desegmented option is selected in the
<Preferences/Protocols/Q.931
menu.
I guess that it is
the TCP perference settings you may have to change:
Preferences/Protocols/TCP/Allow subdissector desegment
TCP streams (must be enabled, check the checkbox)
*** The default is
that this setting is disabled after installation, I
think.
*** You will get the
behviour with "Short frames" if this is not done.
Preferences/Protocols/TCP/Check the validity of
TCP checksum when possible (may need to be disabled, uncheck the
checkbox)
*** The default is that this setting is enabled after
installation, I think.
*** In case of checksum calculation
offload TCP desegmentation may not work e.g. for outgoing packets on the computer where the capture
is made.
There are some other
settings you may need to look at also:
Preferences/Protocols/TPKT/Desegment all TPKT messages
spanning multiple TCP segments (should be enabled, check the
checkbox)
Preferences/Protocols/Q931/Desegment all Q.931
messages spanning multiple TCP segments (should be enabled, check the
checkbox)
Preferences/Protocols/H225/Reassemble H.225 over TCP
(should be enabled, check the checkbox)
Preferences/Protocols/H245/Reassemble H.225 over TCP
(should be enabled, check the checkbox)
*** These preference
settings normally have these values by default
Preferences/Protocols/IP/Reassemble fragmented IP
datagrams
*** The default is that this setting is
disabled after installation, I think. (should be enabled, check the
checkbox)