MiNET Wireshark Dissector/Decoder Plugin?

[neocec]

Hey all,

I've been reading a bunch of posts on this and apparently a plugin existed for Wireshark that could read MiNET call signaling data, but I haven't had any luck finding it. I know MiNET is a proprietary protocol from Mitel. Just wondering if anyone knows what happened to it and if it can still be downloaded somewhere?

Thanks

John

[acejavelin]

I haven't seen this in a long time, and a quick search confirms all the sources mentioned are about 4-6 years old and are gone now, although someone here might have it... seems to me it used to work well but somewhere along the line it quit working, perhaps an upgrade to wireshark.

I did notice in the Linux man page for wireshark there is a contributor listed with a Mitel email address, brian_bogora@mitel.com, perhaps emailing him could assist you, the man page was last updated in 2014 though?

I think many here, including myself, would be interested if you are able to come up with something.

[boycey9]

It was never available as a plug in it was embedded in an old version of Wireshark (0.99 I think) and when you upgraded it vanished. To be fair it didnt do much just enabled you to see things like call answered, put on hold etc. Not used it in years and not missed it one bit.

[neocec]

Thanks guys. I managed to find the version of Wirekshark that boycey9 was talking about. Although MINET is listed under "Enabled Protocols" in this version of Wireshark, boycey9 is correct, it doesn't decode much of anything. I would attach it here but there's only a 10MB limit and it's a 13MB file. But I have attached the DLL Plugin file found after it's extracted. I have attached it in this post.

Here's the URL for the full Wireshark file that I found:
http://cid-2d43cebcb126d89b.skydrive.live.com/self.aspx/Downloads/Mitel/wireshark-setup-0%5B1%5D.99.6a-1.2.8.1withMitel.rar?sa=971028122

So is there an alternative program to Wireshark that can be used to read MiNET signalling and RTP data? Would really help for troubleshooting VoIP issues.

Thanks,

John

[ralph]

Neocec,
If you can send me a link to the 13meg file where I can DL it from dropbox or what ever you use, I'll build a page where it can be downloaded from my dropbox account.

Ralph

[neocec]

Hey Ralph,

I posted the link to download it already in my last post. It's on a guy's OneDrive. You'll see it once you click the link. Just right-click and download the file.

John

[ralph]

Ah.  For some reason I didn't think it was the whole thing.

Thanks.

Ralph

[wingnut]

Hi All

This is an open invitation for anyone  who has inside Mitel knowledge and knowledge of MiNET to work with me to create a mitel dissector for Wireshark. ( I will write the dissector )
I’m a data guy but spend a lot of my time working on Mitel / UC issues. But the fact we cannot interpret any of the signalling is crippling.

Obviously with SIP its is possible to see CLI information ect which very useful when a customer reports a specific issue.
Simon



 

[ralph]

I believe that the MiNet protocol is now encrypted.
That isn't an option you can change in system options.
Mitel needed a capture once from me and I had to have them drop to the CLI and turn off encryption before I could get it for them.

Ralph

[wingnut]

Thanks Ralph, that probably explains why there is not one already.
I wonder what they did to turn off the encryption, its easy enough to turn off the RTP encryption if enabled.

problem I have as a data guy is finding the correct RTP stream on a busy network. 
with SIP its as easy as anything, but on the mitel side I end up decoding about 20 rtp steams trying to reconcile it with the customer report.

Regards

Simon

[petr.necas]

Hi Ralph,
   as far as I know it is possible to disable the RTP encryption but not the MiNET signalling encryption. If you know how to do it, could you please share it here?
Petr

[acejavelin]

Hi Ralph,
   as far as I know it is possible to disable the RTP encryption but not the MiNET signalling encryption. If you know how to do it, could you please share it here?
Petr

It's in the System Options form towards the bottom... "Voice Encryption Enabled" and "Voice/Video SRTP Encryption Enabled". Does not require a reboot, current calls are unaffected but all calls starting after that point are changed.

Unless you have very unusual requirements, turning this off is not recommended except for troubleshooting or at the request of technical support.

[ralph]

Hi Ralph,
   as far as I know it is possible to disable the RTP encryption but not the MiNET signalling encryption. If you know how to do it, could you please share it here?
Petr

It's in the System Options form towards the bottom... "Voice Encryption Enabled" and "Voice/Video SRTP Encryption Enabled". Does not require a reboot, current calls are unaffected but all calls starting after that point are changed.

Unless you have very unusual requirements, turning this off is not recommended except for troubleshooting or at the request of technical support.

 That's what I thought too. It wasn't the same thing.  It was something that engineering had to turn off via the CLI that did not survive a reboot.

Ralph

[acejavelin]

Hi Ralph,
   as far as I know it is possible to disable the RTP encryption but not the MiNET signalling encryption. If you know how to do it, could you please share it here?
Petr

It's in the System Options form towards the bottom... "Voice Encryption Enabled" and "Voice/Video SRTP Encryption Enabled". Does not require a reboot, current calls are unaffected but all calls starting after that point are changed.

Unless you have very unusual requirements, turning this off is not recommended except for troubleshooting or at the request of technical support.

 That's what I thought too. It wasn't the same thing.  It was something that engineering had to turn off via the CLI that did not survive a reboot.

Ralph

Hmm... Interesting... When support has had me take packet captures in the past, this is all they have had me do. Granted, it's been a few years since I've had to do it that way.

Sent from my Moto G (5) Plus using Tapatalk

[moeller]

Hello everyone - does anyone have this plugin?

Unfortunately the link above is dead 

Thanks in advance