Hi Billy -

Apologies for the delay in providing the Webinar details to you. Please find a link to the Slides and Cheat Sheet below:

Handout - Troubleshooting DICOM and HL7 with Wireshark
Troubleshooting DICOM with Wireshark

Recorded Webinar: https://infocentral.infoway-inforoute.ca/en/collaboration/communities/enterprise-imaging

Thx,
J

Thanks you both for the quick response!

Hi Billy - I expect that the webinar will be posted early next week. It will be shared on this thread.

Stay tuned

Thx,
J

# DO NOT EDIT THIS FILE! It was created by Wireshark
@DICOM N_ACTION_RSP@dicom contains 02:00:00:00:30:81@[43690,0,0][65535,65535,65535]
@DICOM N_ACTION_RQ@dicom contains 02:00:00:00:30:01@[21845,0,32639][65535,65535,65535]
!@Bad This email address is being protected from spambots. You need JavaScript enabled to view it. && !tcp.analysis.window_update@[4626,10023,11822][63479,34695,34695]
!@HSRP State This email address is being protected from spambots. You need JavaScript enabled to view it. != 8 && hsrp.state != 16@[4626,10023,11822][65535,64764,40092]
!@Spanning Tree Topology This email address is being protected from spambots. You need JavaScript enabled to view it. == 0x80@[4626,10023,11822][65535,64764,40092]
!@OSPF State This email address is being protected from spambots. You need JavaScript enabled to view it. != 1@[4626,10023,11822][65535,64764,40092]
!@ICMP This email address is being protected from spambots. You need JavaScript enabled to view it. eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11 || icmpv6.type eq 1 || icmpv6.type eq 2 || icmpv6.type eq 3 || icmpv6.type eq 4@[4626,10023,11822][47031,63479,29812]
!@ARP@arp@[64250,61680,55255][4626,10023,11822]
!@ICMP@icmp || icmpv6@[64764,57568,65535][4626,10023,11822]
!@TCP This email address is being protected from spambots. You need JavaScript enabled to view it. eq 1@[42148,0,0][65535,64764,40092]
!@SCTP ABORT@sctp.chunk_type eq ABORT@[42148,0,0][65535,64764,40092]
!@TTL low or unexpected@( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim && !ospf) || (ip.dst == 224.0.0.0/24 && ip.dst != 224.0.0.251 && ip.ttl != 1 && !(vrrp || carp))@[42148,0,0][60652,61680,60395]
!@Checksum Errors@eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" || edp.checksum.status=="Bad" || wlan.fcs.status=="Bad" || stt.checksum.status=="Bad"@[4626,10023,11822][63479,34695,34695]
!@SMB@smb || nbss || nbns || netbios@[65278,65535,53456][4626,10023,11822]
!@HTTP@http || tcp.port == 80 || http2@[58596,65535,51143][4626,10023,11822]
!@DCERPC@dcerpc@[51143,38807,65535][4626,10023,11822]
!@Routing@hsrp || eigrp || ospf || bgp || cdp || vrrp || carp || gvrp || igmp || ismp@[65535,62451,54998][4626,10023,11822]
!@TCP SYN/FIN@tcp.flags & 0x02 || tcp.flags.fin == 1@[41120,41120,41120][4626,10023,11822]
!@TCP@tcp@[59367,59110,65535][4626,10023,11822]
!@UDP@udp@[56026,61166,65535][4626,10023,11822]
!@Broadcast@eth[0] & 1@[65535,65535,65535][47802,48573,46774]
!@System Event@systemd_journal || sysdig@[59110,59110,59110][11565,28527,39578]
@HL7 ACK@hl7.message.type==ACK@[65535,65535,32639][0,21845,0]
@HL7 ORU@hl7.message.type==ORU@[43690,65535,65535][21845,0,32639]
@HL7 ADT@hl7.message.type==ADT@[21845,43690,0][43690,0,0]
@HL7 ORM@hl7.message.type==ORM@[21845,0,65535][65535,0,65535]
@DICOM C_STORE_RQ@dicom contains 00:00:00:01:02:00:00:00:01:00@[21845,21845,0][0,0,0]
@DICOM C_STORE_RSP@dicom contains 02:00:00:00:01:80@[21845,21845,32639][0,0,0]
@DICOM C_MOVE_RQ@dicom contains 02:00:00:00:21:00@[43690,21845,0][0,0,0]
@DICOM C_MOVE_RSP @dicom contains 02:00:00:00:21:80@[0,43690,0][0,0,0]
@DICOM C_FIND_RQ@dicom contains 02:00:00:00:20:00@[65535,43690,0][0,0,0]
@DICOM C_FIND_RSP@dicom contains 02:00:00:00:20:80@[43690,43690,65535][0,0,0]
@DICOM C-ECHO RSP@dicom contains 02:00:00:00:30:80@[65535,0,32639][0,0,0]
@DICOM C-ECHO RQ@dicom contains 02:00:00:00:30:00@[0,65535,65535][0,0,0]
@DICOM N_EVENT_REPORT_RQ@dicom contains 02:00:00:00:00:01@[65535,65535,0][65535,0,0]
@DICOM N_EVENT_REPORT_RSP@dicom contains 02:00:00:00:00:81@[0,0,65535][65535,65535,0]

Hi Everyone –

Just a reminder, that we have an upcoming webinar this Friday and there are some changes to how participants connect to the webinar, and registration is now required.

This Friday @ 12pm EST, Luiz Aizawa will demonstrate how to use Wireshark to troubleshoot DICOM associations. This webinar will show the attendees how to configure, perform package capturing, and filtering to get information from a DICOM connection.

The Learning Objectives for the webinar are:

• Understand DICOM network association fundamentals
• Identify how to use Wireshark network sniffer to troubleshoot DICOM associations

Register in advance:
https://infoway-inforoute.zoom.us/meeting/register/tJcqdOCsrTwrHda1g2JsQu1ddNhgxJHsmeFU

After registering, you will receive a confirmation email containing information about joining the meeting.

Thx,
J