On Jan 12, 2009, at 7:45 PM, ping wen wrote:
I am using wireshark study h.248. Before start megaco protocol,
the gateway connect mgc for Ip and phone num map. But wireshark
found this connect use LAPD and Q.931. I don't why these packtes are
looked as LAPD? In my mind, LAPD is layer 2 protocol, and my layer 2
is ethernet undoubtly.
Yes, but there are a lot of different mechanisms for transporting
various types of layer 2 protocols on top of other higher-level
protocols.
Cisco, apparently, sends Q.931 atop LAPD inside UDP:
http://www.cisco.com/en/US/docs/ios/12_0t/12_0t3/feature/guide/rlm_123.html
How does wireshare judge these LAPD packts?
The Wireshark dissector for Cisco's RLM (Redundant Link Management)
feature tries to "guess" which UDP packets have Q.931-atop-LAPD - but
it does it with a *VERY* weak scheme; it only checks the port number
for ports in the range 3001-3015. Unfortunately, if non-RLM traffic
goes over UDP ports 3001-3015, that can cause Wireshark to treat that
traffic as RLM traffic even if it isn't.
The RLM dissector needs to use a better heuristic - one that looks at
the packet *data* - as those packets don't look like valid LAPD packets.