Using the toolkit for sniffing

[Tamás Sipos]

There is an analyzer PC on the network, it sees the whole communication happening between the modalities and the PACS,

which means, it receives every network packet leaving the PACS, going to a modality.

This PC's task would be to extract the StudyUID, whenever a DICOM Study is transmitted to any modality over the network from the PACS,

so whenever a C-STORE happens on any client. (For example a DICOM Viewer retrieves a Study from the PACS)

Could the dcm4che toolkit be used for that purpose? As part of a JAVA application constantly monitoring network traffic "as a passive observer"

to analyze DICOM data streams (network packets) to find out if a C-STORE happens, then get the UID of the Study which is being transmitted to a modality.

I already did a lot Java programming using the dcm4che toolkit, but have no idea how I could accomplish this one.

[fleetwoodfc]

https://www.dvtk.org/dicom/network-analyzer/

or

https://www.nextgen.com/products-and-services/integration-engine (Mirth Connect)

[Tamás Sipos]

Thanks!

However, of these applications I know already, and I'd don't want to use an external tool.
I'd like to implement it in Java

I don't know how complicated it would be, but I already made some progress:

I can capture the packages already, and also extract the payload from the TCP packages.

From here it should not be that far, because I guess it's already the raw DICOM data.

I just don't know how to parse the payloads.

[Tamás Sipos]

Right now I'm testing it by sending a C-ECHO to ORTHANC from the dcm4che toolkit,

capture the tcp packages on the dicom port,

extract their payloads,

convert the byte array to string using utf-8,

and I'm getting this:

� ORTHANC STORESCU 1.2.840.10008.3.1.1.1 . 0 1.2.840.10008.1.1@ 1.2.840.10008.1.2P5Q ?�R1.2.40.0.13.1.3S Udcm4che-5.14.1
� ORTHANC STORESCU 1.2.840.10008.3.1.1.1! @ 1.2.840.10008.1.2P:Q @R 1.2.276.0.7230010.3.0.3.6.2UOFFIS_DCMTK_362
JF 8 1.2.840.10008.1.1 0
TP
B 1.2.840.10008.1.1 0�

I'm getting nearer, but I still miss something at the decoding of the payloads.. Any ideas?

Update: Some unknown characters have been lost when copying the code onto this website, so it's actually a little uglier than this.