Ethereal-users: Re: [Ethereal-users] Help with DICOM decode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 14 Oct 2004 15:45:28 -0700
Bob Woods wrote:
I'm using version 0.10.6 and I can't seem to see any decode for DICOM. I see it in the list of enabled protocols but I don't see it in the decode list. I know I have a valid DICOM capture file because it decodes in the Merge DPM. Could somebody please explain on how to view the DICOM data.

The way to view the DICOM data is to make sure that the first packet in the TCP connection with TCP payload:

	has at least 10 bytes of TCP payload;

	has 1 as the first of those bytes;

	has 1 as the 7th byte;

has, as the length field starting with the 3rd byte, a value that, when 6 is added to it, is >= the amount of data in the TCP payload.

This is because the DICOM dissector is a "heuristic" dissector, meaning that, instead of looking for traffic on a particular port, it is one of a set of dissectors called for TCP packets regardless of the port number. I infer that this is because there's no standard port number for DICOM - I don't know whether that's the case.

This also means that if some *other* heuristic dissector accepts the packet before the DICOM dissector is called, the packet won't be recognized as a DICOM packet.

I infer from the code that "has 1 as the first of those bytes" means that the first packet in the TCP connection must be an "ASSOC Request". If that's not the case, the current DICOM dissector won't recognize any of the packets in the connection.