3 * Routines for RFC 2833 RTP Events dissection
4 * Copyright 2003, Kevin A. Noll <knoll[AT]poss.com>
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * SPDX-License-Identifier: GPL-2.0-or-later
11 * Ref https://tools.ietf.org/html/rfc4733
15 * This dissector tries to dissect RTP Events.
17 * Cisco NSE is now supported, additions by
18 * Gonzalo Salgueiro <gsalguei@cisco.com>
19 * Chidambaram Arunachalam <carunach@cisco.com>
20 * Copyright 2008, Cisco Systems, Inc.
26 #include <epan/packet.h>
27 #include <epan/prefs.h>
28 #include <epan/proto_data.h>
30 #include "packet-rtp-events.h"
31 #include "packet-rtp.h"
34 void proto_register_rtp_events(void);
35 void proto_reg_handoff_rtp_events(void);
37 /* 101 for RTP Event, 100 for Cisco NSE */
38 #define RTP_EVENT_DEFAULT_PT_RANGE "100-101"
40 /* RTP Event Fields */
42 static int proto_rtp_events
;
43 static int rtp_event_tap
;
45 static int hf_rtp_events_event
; /* one byte */
46 static int hf_rtp_events_end
; /* one bit */
47 static int hf_rtp_events_reserved
; /* one bit */
48 static int hf_rtp_events_volume
; /* six bits */
49 static int hf_rtp_events_duration
; /* sixteen bits */
62 #define RTP_DTMF_STAR 10
63 #define RTP_DTMF_POUND 11
68 #define RTP_DTMF_FLASH 16
73 #define RTP_ANSAMREV 35
75 #define RTP_V21C1B0 37
76 #define RTP_V21C1B1 38
77 #define RTP_V21C2B0 39
78 #define RTP_V21C2B1 40
89 #define RTP_OFFHOOK 64
91 #define RTP_DIALTONE 66
96 #define RTP_SPRGTONE 71
97 #define RTP_BUSYTONE 72
98 #define RTP_CNGTONE 73
99 #define RTP_SPINFOTN 74
100 #define RTP_CMFTTONE 75
101 #define RTP_HOLDTONE 76
102 #define RTP_RECTONE 77
103 #define RTP_CLRWTTONE 78
104 #define RTP_CWTONE 79
105 #define RTP_PAYTONE 80
106 #define RTP_POSINDTONE 81
107 #define RTP_NEGINDTONE 82
108 #define RTP_WARNTONE 83
109 #define RTP_INTRTONE 84
110 #define RTP_CALLCDTONE 85
111 #define RTP_PAYPHONE 86
113 #define RTP_OFFHKWARN 88
116 #define RTP_ACCPTTONE 96
117 #define RTP_CONFIRMTN 97
118 #define RTP_DLTNRECALL 98
119 #define RTP_END3WAYTN 99
120 #define RTP_FACTONE 100
121 #define RTP_LNLOCKTN 101
122 #define RTP_NUMUNOBT 102
123 #define RTP_OFFERGTONE 103
124 #define RTP_PERMSIGTN 104
125 #define RTP_PREEMPTTN 105
126 #define RTP_QUETONE 106
127 #define RTP_REFUSALTN 107
128 #define RTP_ROUTETONE 108
129 #define RTP_VALIDTONE 109
130 #define RTP_WAITGTONE 110
131 #define RTP_WARNEOPTN 111
132 #define RTP_WARNPIPTN 112
152 #define RTP_WINKOFF 161
153 #define RTP_INCSEIZ 162
154 #define RTP_SEIZURE 163
155 #define RTP_UNSEIZE 164
157 #define RTP_DEFCOT 166
158 #define RTP_COTTONE 167
159 #define RTP_COTSEND 168
161 #define RTP_COTVERFD 170
162 #define RTP_LOOPBACK 171
163 #define RTP_MWATTTONE 172
164 #define RTP_NEWMWATTTN 173
166 #define RTP_CISCO_NSE_FAX_PASSTHROUGH_IND 192
167 #define RTP_CISCO_NSE_MODEM_PASSTHROUGH_IND 193
168 #define RTP_CISCO_NSE_VOICE_MODE_IND 194
169 #define RTP_CISCO_NSE_MODEM_RELAY_CAP_IND 199
170 #define RTP_CISCO_NSE_FAX_RELAY_IND 200
171 #define RTP_CISCO_NSE_ACK 201
172 #define RTP_CISCO_NSE_NACK 202
173 #define RTP_CISCO_NSE_MODEM_RELAY_IND 203
175 /* https://www.iana.org/assignments/audio-telephone-event-registry/audio-telephone-event-registry.xml */
176 static const value_string rtp_event_type_values
[] =
178 { RTP_DTMF_0
, "DTMF Zero 0" },
179 { RTP_DTMF_1
, "DTMF One 1" },
180 { RTP_DTMF_2
, "DTMF Two 2" },
181 { RTP_DTMF_3
, "DTMF Three 3" },
182 { RTP_DTMF_4
, "DTMF Four 4" },
183 { RTP_DTMF_5
, "DTMF Five 5" },
184 { RTP_DTMF_6
, "DTMF Six 6" },
185 { RTP_DTMF_7
, "DTMF Seven 7" },
186 { RTP_DTMF_8
, "DTMF Eight 8" },
187 { RTP_DTMF_9
, "DTMF Nine 9" },
188 { RTP_DTMF_STAR
, "DTMF Star *" },
189 { RTP_DTMF_POUND
, "DTMF Pound #" },
190 { RTP_DTMF_A
, "DTMF A" },
191 { RTP_DTMF_B
, "DTMF B" },
192 { RTP_DTMF_C
, "DTMF C" },
193 { RTP_DTMF_D
, "DTMF D" },
194 { RTP_DTMF_FLASH
, "Flash" },
195 /* 17-22 Unassigned*/
196 { 23, "CRdSeg: second segment of V.8 bis CRd signal" }, // [RFC4734]
197 { 24, "CReSeg : second segment of V.8 bis CRe signal" }, // [RFC4734]
198 { 25, "MRdSeg : second segment of V.8 bis MRd signal" }, // [RFC4734]
199 { 26, "MReSeg : second segment of V.8 bis MRe signal" }, // [RFC4734]
200 { 27, "V32AC : A pattern of bits modulated at 4800 bits / s, emitted by a V.32 / V.32bis answering terminal upon detection of the AA pattern." }, // [RFC4734]
201 { 28, "V8bISeg : first segment of initiating V.8 bis signal" }, // [RFC4734]
202 { 29, "V8bRSeg : first segment of responding V.8 bis signal" }, // [RFC4734]
203 { 30, "V21L300 : 300 bits / s low channel V.21 indication" }, // [RFC4734]
204 { 31, "V21H300 : 300 bits / s high channel V.21 indication" }, // [RFC4734]
205 { RTP_ANS
, "Fax ANS"},
206 { RTP_ANSREV
, "Fax /ANS"},
207 { RTP_ANSAM
, "Fax ANSam"},
208 { RTP_ANSAMREV
, "Fax /ANSam"},
209 { RTP_CNG
, "Fax CNG"},
210 { RTP_V21C1B0
, "V.21 channel 1, 0 bit"},
211 { RTP_V21C1B1
, "V.21 channel 1, 1 bit"},
212 { RTP_V21C2B0
, "V.21 channel 2, 0 bit"},
213 { RTP_V21C2B1
, "V.21 channel 2, 1 bit"},
214 { RTP_CRDI
, "Fax CRdi"},
215 { RTP_CRDR
, "Fax CRdr"},
216 { RTP_CRE
, "Fax CRe"},
217 { RTP_ESI
, "Fax ESi"},
218 { RTP_ESR
, "Fax ESr"},
219 { RTP_MRDI
, "Fax MRdi"},
220 { RTP_MRDR
, "Fax MRdr"},
221 { RTP_MRE
, "Fax MRe"},
223 /* 50-51 Unassigned*/
224 { 52, "ANS2225: 2225 Hz indication for text telephony" }, // [RFC4734]
225 { 53, "CI(V.8 Call Indicator signal preamble)" }, // [RFC4734]
226 { 54, "V.21 preamble flag(T.30)" }, // [RFC4734]
227 { 55, "V21L110 : 110 bits / s V.21 indication for text telephony" }, // [RFC4734]
228 { 56, "B103L300 : Bell 103 low channel indication for text telephony" }, // [RFC4734]
229 { 57, "V23Main : V.23 main channel indication for text telephony" }, // [RFC4734]
230 { 58, "V23Back : V.23 back channel indication for text telephony" }, // [RFC4734]
231 { 59, "Baud4545 : 45.45 bits / s Baudot indication for text telephony" }, // [RFC4734]
232 { 60, "Baud50 : 50 bits / s Baudot indication for text telephony" }, // [RFC4734]
233 { 61, "VBDGen : Tone patterns indicative of use of an unidentified modem type" }, // [RFC4734]
234 { 62, "XCIMark : A pattern of bits modulated in the V.23 main channel, emitted by a V.18 calling terminal" }, // [RFC4734]
235 { 63, "V32AA : A pattern of bits modulated at 4800 bits / s, emitted by a V.32 / V.23bis calling terminal" }, // [RFC4734]
236 { RTP_OFFHOOK
, "Off Hook"},
237 { RTP_ONHOOK
, "On Hook"},
238 { RTP_DIALTONE
, "Dial tone"},
239 { RTP_INTDT
, "PABX internal dial tone"},
240 { RTP_SPCDT
, "Special dial tone"},
241 { RTP_2NDDT
, "Second dial tone"},
242 { RTP_RGTONE
, "Ringing tone"},
243 { RTP_SPRGTONE
, "Special ringing tone"},
244 { RTP_BUSYTONE
, "Busy tone"},
245 { RTP_CNGTONE
, "Congestion tone"},
246 { RTP_SPINFOTN
, "Special information tone"},
247 { RTP_CMFTTONE
, "Comfort tone"},
248 { RTP_HOLDTONE
, "Hold tone"},
249 { RTP_RECTONE
, "Record tone"},
250 { RTP_CLRWTTONE
, "Caller waiting tone"},
251 { RTP_CWTONE
, "Call waiting tone"},
252 { RTP_PAYTONE
, "Pay tone"},
253 { RTP_POSINDTONE
, "Positive indication tone"},
254 { RTP_NEGINDTONE
, "Negative indication tone"},
255 { RTP_WARNTONE
, "Warning tone"},
256 { RTP_INTRTONE
, "Intrusion tone"},
257 { RTP_CALLCDTONE
, "Calling card service tone"},
258 { RTP_PAYPHONE
, "Payphone recognition tone"},
259 { RTP_CAS
, "CPE alerting signal (CAS)"},
260 { RTP_OFFHKWARN
, "Off-hook warning tone"},
262 { RTP_ACCPTTONE
, "Acceptance tone"},
263 { RTP_CONFIRMTN
, "Confirmation tone"},
264 { RTP_DLTNRECALL
, "Dial tone, recall"},
265 { RTP_END3WAYTN
, "End of three party service tone"},
266 { RTP_FACTONE
, "Facilities tone"},
267 { RTP_LNLOCKTN
, "Line lockout tone"},
268 { RTP_NUMUNOBT
, "Number unobtainable tone"},
269 { RTP_OFFERGTONE
, "Offering tone"},
270 { RTP_PERMSIGTN
, "Permanent signal tone"},
271 { RTP_PREEMPTTN
, "Preemption tone"},
272 { RTP_QUETONE
, "Queue tone"},
273 { RTP_REFUSALTN
, "Refusal tone"},
274 { RTP_ROUTETONE
, "Route tone"},
275 { RTP_VALIDTONE
, "Valid tone"},
276 { RTP_WAITGTONE
, "Waiting tone"},
277 { RTP_WARNEOPTN
, "Warning tone (end of period)"},
278 { RTP_WARNPIPTN
, "Warning Tone (PIP tone)"},
279 { 115, "North American SIT Segment 1 Low" }, // [GR - 674]
280 { 116, "North American SIT Segment 1 High" }, // [GR - 674]
281 { 117, "North American SIT Segment 2 Low" }, // [GR - 674]
282 { 118, "North American SIT Segment 2 High" }, // [GR - 674]
283 { 119, "North American SIT Segment 3" }, // [GR - 674]
284 { 120, "North American Coin Deposit" }, // [GR - 506]
285 { 121, "Continuity check - tone" }, // [RFC5244]
286 { 122, "Continuity verify - tone" }, // [RFC5244]
287 { 123, "MF Code 11 (SS No. 5) or KP3P / ST3P(R1) or North American Ringback" }, // [GR-506]
288 { 124, "MF KP(SS No. 5) or KP1(R1) or North American Coin Return" }, // [GR-506]
289 { 125, "MF KP2(SS No. 5) or KP2P / ST2P(R1)" }, // [RFC5244]
290 { 126, "MF ST(SS No. 5 and R1) or North American Coin Collect / Operator Released" }, // [GR-506]
291 { 127, "MF Code 12 (SS No. 5) or KP'/STP (R1)" },
302 { RTP_K0
, "MF K0 or KP (start-of-pulsing)"},
305 { RTP_S0
, "MF S0 to ST (end-of-pulsing)"},
308 { 144, "ABCD signalling state '0000'" }, // [RFC5244]
309 { 145, "ABCD signalling state '0001'" }, // [RFC5244]
310 { 146, "ABCD signalling state '0010'" }, // [RFC5244]
311 { 147, "ABCD signalling state '0011'" }, // [RFC5244]
312 { 148, "ABCD signalling state '0100'" }, // [RFC5244]
313 { 149, "ABCD signalling state '0101'" }, // [RFC5244]
314 { 150, "ABCD signalling state '0110'" }, // [RFC5244]
315 { 151, "ABCD signalling state '0111'" }, // [RFC5244]
316 { 152, "ABCD signalling state '1000'" }, // [RFC5244]
317 { 153, "ABCD signalling state '1001'" }, // [RFC5244]
318 { 154, "ABCD signalling state '1010'" }, // [RFC5244]
319 { 155, "ABCD signalling state '1011'" }, // [RFC5244]
320 { 156, "ABCD signalling state '1100'" }, // [RFC5244]
321 { 157, "ABCD signalling state '1101'" }, // [RFC5244]
322 { 158, "ABCD signalling state '1110'" }, // [RFC5244]
323 { 159, "ABCD signalling state '1111'" }, // [RFC5244]
325 { RTP_WINKOFF
, "Wink off"},
326 { RTP_INCSEIZ
, "Incoming seizure"},
327 { RTP_SEIZURE
, "Seizure"},
328 { RTP_UNSEIZE
, "Unseize circuit"},
329 { RTP_COT
, "Continuity test"},
330 { RTP_DEFCOT
, "Default continuity tone"},
331 { RTP_COTTONE
, "Continuity tone (single tone)"},
332 { RTP_COTSEND
, "Continuity test send"},
333 { RTP_COTVERFD
, "Continuity verified"},
334 { RTP_LOOPBACK
, "Loopback"},
335 { RTP_MWATTTONE
, "Old milliwatt tone (1000 Hz)"},
336 { RTP_NEWMWATTTN
, "New milliwatt tone (1004 Hz)"},
337 { 174, "Metering pulse" }, // [RFC5244]
338 { 175, "Trunk unavailable" }, // [RFC5244]
339 { 176, "MFC forward signal 1" }, // [RFC5244]
340 { 177, "MFC forward signal 2" }, // [RFC5244]
341 { 178, "MFC forward signal 3" }, // [RFC5244]
342 { 179, "MFC forward signal 4" }, // [RFC5244]
343 { 180, "MFC forward signal 5" }, // [RFC5244]
344 { 181, "MFC forward signal 6" }, // [RFC5244]
345 { 182, "MFC forward signal 7" }, // [RFC5244]
346 { 183, "MFC forward signal 8" }, // [RFC5244]
347 { 184, "MFC forward signal 9" }, // [RFC5244]
348 { 185, "MFC forward signal 10" }, // [RFC5244]
349 { 186, "MFC forward signal 11" }, // [RFC5244]
350 { 187, "MFC forward signal 12" }, // [RFC5244]
351 { 188, "MFC forward signal 13" }, // [RFC5244]
352 { 189, "MFC forward signal 14" }, // [RFC5244]
353 { 190, "MFC forward signal 15" }, // [RFC5244]
354 { 191, "MFC backward signal 1" }, // [RFC5244]
355 //{ 192, "MFC backward signal 2" }, // [RFC5244]
357 //193 MFC backward signal 3[RFC5244]
358 //194 MFC backward signal 4[RFC5244]
359 //195 MFC backward signal 5[RFC5244]
360 //196 MFC backward signal 6[RFC5244]
361 //197 MFC backward signal 7[RFC5244]
362 //198 MFC backward signal 8[RFC5244]
363 //199 MFC backward signal 9[RFC5244]
364 //200 MFC backward signal 10[RFC5244]
365 //201 MFC backward signal 11[RFC5244]
366 //202 MFC backward signal 12[RFC5244]
367 //203 MFC backward signal 13[RFC5244]
368 //204 MFC backward signal 14[RFC5244]
369 //205 MFC backward signal 15[RFC5244]
370 //206 A bit signalling state '0'[RFC5244]
371 //207 A bit signalling state '1'[RFC5244]
372 //208 AB bit signalling state '00'[RFC5244]
373 //209 AB bit signalling state '01'[RFC5244]
374 //210 AB bit signalling state '10'[RFC5244]
375 //211 AB bit signalling state '11' [RFC5244]
376 { RTP_CISCO_NSE_FAX_PASSTHROUGH_IND
, "Cisco NSE: Shift to voiceband data mode"},
377 { RTP_CISCO_NSE_MODEM_PASSTHROUGH_IND
, "Cisco NSE: Disable echo cancellation"},
378 { RTP_CISCO_NSE_VOICE_MODE_IND
, "Cisco NSE: Shift to voice mode"},
379 { RTP_CISCO_NSE_MODEM_RELAY_CAP_IND
, "Cisco NSE: Advertise Modem relay capability"},
380 { RTP_CISCO_NSE_FAX_RELAY_IND
, "Cisco NSE: Shift to fax relay mode"},
381 { RTP_CISCO_NSE_ACK
, "Positive acknowledgement of Cisco NSE"},
382 { RTP_CISCO_NSE_NACK
, "Negative acknowledgement of Cisco NSE"},
383 { RTP_CISCO_NSE_MODEM_RELAY_IND
, "Cisco NSE: Shift to modem relay mode"},
386 value_string_ext rtp_event_type_values_ext
= VALUE_STRING_EXT_INIT(rtp_event_type_values
);
388 /* RTP Events fields defining a subtree */
390 static int ett_rtp_events
;
392 static dissector_handle_t rtp_events_handle
;
394 static struct _rtp_event_info rtp_event_info
;
397 dissect_rtp_events( tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void* data _U_
)
400 proto_tree
*rtp_events_tree
;
401 unsigned int offset
= 0;
403 struct _rtp_packet_info
*p_packet_data
;
407 static int * const events
[] = {
409 &hf_rtp_events_reserved
,
410 &hf_rtp_events_volume
,
414 col_set_str(pinfo
->cinfo
, COL_PROTOCOL
, "RTP EVENT");
415 col_clear(pinfo
->cinfo
, COL_INFO
);
418 /* Get event fields */
420 rtp_evt
= tvb_get_uint8(tvb
, offset
);
423 rtp_event_info
.info_rtp_evt
= rtp_evt
;
425 p_packet_data
= (struct _rtp_packet_info
*)p_get_proto_data(wmem_file_scope(), pinfo
, proto_get_id_by_filter_name("rtp"), RTP_CONVERSATION_PROTO_DATA
);
427 rtp_event_info
.info_setup_frame_num
= p_packet_data
->frame_number
;
429 rtp_event_info
.info_setup_frame_num
= 0;
432 col_add_fstr( pinfo
->cinfo
, COL_INFO
,
433 "Payload type=RTP Event, %s",
434 val_to_str_ext( rtp_evt
, &rtp_event_type_values_ext
, "Unknown (%u)" ));
436 ti
= proto_tree_add_item( tree
, proto_rtp_events
, tvb
, offset
, -1, ENC_NA
);
437 rtp_events_tree
= proto_item_add_subtree( ti
, ett_rtp_events
);
439 proto_tree_add_uint ( rtp_events_tree
, hf_rtp_events_event
, tvb
, offset
, 1, rtp_evt
);
441 octet
= tvb_get_uint8(tvb
, offset
);
442 proto_tree_add_bitmask_list(rtp_events_tree
, tvb
, offset
, 1, events
, ENC_NA
);
445 /* The duration field indicates the duration of the event or segment
446 * being reported, in timestamp units.
448 rtp_event_info
.info_duration
= tvb_get_ntohs(tvb
, offset
);
449 proto_tree_add_item ( rtp_events_tree
, hf_rtp_events_duration
, tvb
, offset
, 2, ENC_BIG_ENDIAN
);
451 /* set the end info for the tap */
454 rtp_event_info
.info_end
= true;
457 rtp_event_info
.info_end
= false;
460 /* Make end-of-event packets obvious in the info column */
463 col_append_str(pinfo
->cinfo
, COL_INFO
, " (end)");
466 tap_queue_packet(rtp_event_tap
, pinfo
, &rtp_event_info
);
467 return tvb_captured_length(tvb
);
472 proto_register_rtp_events(void)
475 module_t
*rtp_events_module
;
477 static hf_register_info hf
[] =
480 &hf_rtp_events_event
,
485 BASE_DEC
| BASE_EXT_STRING
,
486 &rtp_event_type_values_ext
,
495 "rtpevent.end_of_event",
504 &hf_rtp_events_reserved
,
516 &hf_rtp_events_volume
,
529 &hf_rtp_events_duration
,
549 proto_rtp_events
= proto_register_protocol("RFC 2833 RTP Event", "RTP Event", "rtpevent");
550 proto_register_field_array(proto_rtp_events
, hf
, array_length(hf
));
551 proto_register_subtree_array(ett
, array_length(ett
));
554 /* Register preferences */
555 rtp_events_module
= prefs_register_protocol (proto_rtp_events
, NULL
);
556 prefs_register_obsolete_preference(rtp_events_module
, "event_payload_type_value");
557 prefs_register_obsolete_preference(rtp_events_module
, "cisco_nse_payload_type_value");
559 rtp_events_handle
= register_dissector("rtpevent", dissect_rtp_events
, proto_rtp_events
);
560 rtp_event_tap
= register_tap("rtpevent");
566 proto_reg_handoff_rtp_events(void)
568 dissector_add_string("rtp_dyn_payload_type", "telephone-event", rtp_events_handle
);
569 dissector_add_string("rtp_dyn_payload_type", "X-NSE", rtp_events_handle
);
570 dissector_add_uint_range_with_preference("rtp.pt", RTP_EVENT_DEFAULT_PT_RANGE
, rtp_events_handle
);
574 * Editor modelines - https://www.wireshark.org/tools/modelines.html
579 * indent-tabs-mode: t
582 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
583 * :indentSize=8:tabSize=8:noTabs=false: