Fill in more of the boiletplate fields.
converted to 1.6 markup
|Deletions are marked like this.||Additions are marked like this.|
|Line 33:||Line 33:|
|A complete list of Sigcomp display filter fields can be found in the [http://www.wireshark.org/docs/dfref/s/sigcomp.html display filter reference]||A complete list of Sigcomp display filter fields can be found in the [[http://www.wireshark.org/docs/dfref/s/sigcomp.html|display filter reference]]|
|Line 40:||Line 40:|
|You cannot directly filter SigComp traffic while capturing. However, if you know the ["UDP"] port used (see above), you can filter on that one.||You cannot directly filter SigComp traffic while capturing. However, if you know the [[UDP]] port used (see above), you can filter on that one.|
|Line 47:||Line 47:|
| * [http://www.ietf.org/rfc/rfc3320.txt?number=3320 rfc3320]
* [http://www.ietf.org/rfc/rfc3321.txt?number=3321 rfc3321]
* [http://www.ietf.org/rfc/rfc4077.txt?number=4077 rfc4077]
| * [[http://www.ietf.org/rfc/rfc3320.txt?number=3320|rfc3320]]
Signaling Compression (SIGCOMP)
Signaling Compression (SigComp), a solution for compressing messages generated by application protocols such as the Session Initiation Protocol (SIP) (RFC 3261) and the Real Time Streaming Protocol (RTSP) (RFC 2326).
Typically, Sigcomp uses the same transport protocol as the compressed protocol.
XXX - Add example decoded traffic for this protocol here (as plain text or Wireshark screenshot).
The SIGCOMP dissector is fully functional, and can display the uploded UDVM code and decompress messages if the messages containing the UDVM code is seen. The SIP library is included. Reassembly of segmented TCP packages is NOT implemented.
The level of detail of UDVM execution can be set, as well as UDP/TCP ports used.
Example capture file
A complete list of Sigcomp display filter fields can be found in the display filter reference
Show only the SigComp based traffic:
Capture only the SigComp traffic over the default SIP UDP port (5060):
udp port 5060