How to Simulate and Troubleshoot Medical Imaging Transfers
By: Dennis Chow
Tags: Cybersecurity, Information Technology, Systems Engineering, Medical Devices, Healthcare Technology

Simulate Image Transfers

It’s time to begin our test cases. Since these are not image acquisition modalities; only DICOM client and servers. We’ll need to grab some de-identified public sample data to ingest into one of our endpoints for transfer. Let’s download 2 sample files from dicomlibrary.com One will be of Modality “OT” type which is short for “Other” and the other will be “CT” which is short for “Computed Tomography”.

Download the following:

File 1 for the CT Modality Anonymized

File 2 for the OT Modality Anonymized

Note: if the links fail or change after the time of this writing, visit the dicomlibrary.com link directly and find two equivalent samples from their public repository.

Unzip the files to a staging location and take note of which file is which as we progress through our test cases.

For our first test case, let’s import both files into Onis 2.5 by clicking the import button, and selecting the directory or file for each study. Notice that the patient name is ‘Anonymized’ which is the standard string for both and the ID is set to ‘0’. Onis free edition will limit you to 15 unique Patient ID’s if you opt to put the images under different patient profiles. Observe the new meta data and the series or images associated with the modalities. You may also opt to view them in their thick client as well.

Import the sample DICOM images to Onis locally

To view the image in a viewer, double click on the icon to the bottom right:

Viewer mode in Onis of one of the DICOM images

Now you’re able to make changes as you wish or add comments or other items as if you were a radiologist or another medical professional. Let’s initiate our first file transfer by pushing this image to the Orthanc server endpoint. After finishing any changes you wish, click file, import, and select ‘ORTHANC’.

Push the DICOM image to the Orthanc Server modality

You may also wish to change some of the metadata associated with this patient health record. Once complete, click ‘Copy to’:

Modify the DICOM image if you desire before pushing to Orthanc

Now observe Wireshark has created a new TCP stream and is transferring the data through the C-STORE protocol command initiated. Wireshark does its best to decode the payload in DICOM format and will parse the headers and the appropriate protocol details. For more information about DICOM network level analysis here an NIH reference with more details on the C-methods and PDU architecture. Observe the varying metadata in the fields and the network level successful image upload as shown as ‘C-STORE-RSP ID=5’ status exit code of 0x00 as the reply. This is followed by the TCP stream tear-down of FIN-ACK.

Packet capture example of a successful image transfer from Onis to Orthanc

From a network forensics stand point; Wireshark also has a built in dissector to carve out DICOM images in their native DCS file extension format. It’s not perfect; especially when there is network latency, errors, or lost packets as this can affect the integrity of how corrupt or complete a DICOM image is. Still, it is mostly reliable in later versions of Wireshark. To accomplish this, do a file, export objects, and DICOM in the menu:

Forensically extract DICOM images out of a packet capture

You can now select the stream per image and click save to save the DCM file and open it natively in any viewer you please locally:

Save the DICOM image locally from the Wireshark packet capture

This is a great way to see if there are significant network issues or other application specific problems causing DICOM image corruption between PACS endpoints.

To observe the image upload(s) in Orthanc navigate back to the explorer home page. Or click on ‘lookup’ on the top left. Now set Patient ID to ‘0’ and click on Do Lookup or click on All Patients. Performing a ‘do lookup’ will show all the files uploaded to the patient:

Search for patient records inside Orthanc

Note: Doing ‘All Patients’ will just load per patient results and show the count of files. Here, I did a lookup by patient ‘0’ and you will notice 2 distinct entries. This is because for the purposes of this lab I uploaded both the CT and OT modality image files from Onis.

A ‘do lookup’ click will show unique files per study ID for the specified patient number

Click on the CT abdomen image that you uploaded. You will be navigated to the patient’s study with the metadata that Onis included in the change as well as the original information from the sample DCS file. Does that series UID look like what you saw in the PCAP? It should because although that’s not the same UID that we displayed in the image. It was a identifier specific to that patient, study, and other hierarchy structure that the DICOM protocol utilized to match which image part or series belongs to whom.

From this window you can elect to use Orthanc’s own DICOM viewer and make edits to the data in its interface or if you’re a developer using its REST API’s. For now, let’s try to transfer this updated image back to Onis 2.5 to update its local index:

Attempt to push DICOM image back to Onis from Orthanc

Click on the ‘Send to DICOM modality’ and you should see a pop up directing our only peer target to ONIS25:

Execute the send DICOM image transfer job to Onis

You should now receive an error:

An expected error attempting to push to Onis

Examining the PCAP data you should now see the attempt of ‘C-STORE’ to the tcp port 104 which is Onis. The response now shows a status error code of 0cx001 which Wireshark interprets this as the endpoint at Onis 2.5 does not understand or process for whatever reason followed by the UID of the image name:

Packet capture troubleshooting the DICOM transfer

While from a network level this is useful in determining that the issue is not the network; this doesn’t help us troubleshoot what is going on at the application layer for the PACS endpoints. In addition, the image was still sent across the wire in the clear. If you do another file export objects; you’ll be able to see the DCS file just as if the transfer was successful!

Let’s examine Onis 2.5 and see if there’s anything in the logs. As we can see there’s nothing here that helps us from this endpoint to help us diagnose our issue. To see this, click preferences, administration, and then the logs tab for more details:

Onis log file does not provide much verbosity of the failure

For the sake of complete testing; we know that the connection peering works in one direction. Can we at least query the Onis index for patient data? After all, we did store these 2 files here first. Navigate back to Orthanc and click on Query/Retrieve. Set the Patient ID to 0 and select ‘CT’ record modality types, and then click on ‘Search studies’:

Try a different method to get files from Onis instead

You should now receive an error when performing a simple query (C-Find) and note that the wireshark capture shows more context as to the UID around the requested details are. However, the pcap becomes even less useful in the status commands. We know what the caller requested, but there is no C-response, only association peering acceptance at the AET connection level:

Error persists connecting to Onis for patient identifiers with packet capture

For better diagnosis, go to the Orthanc server folder directory and open the latest log file. Remember, you’ll have at least 2 logs in there one for each time the service was ran. You can find these logs in windows under: “C:\Program Files\Orthanc Server\Logs”. Scroll to the bottom it will state that the C-Find command is not supported for the queries nor is the store command supported. Both of these are on the Onis target server, yet despite the feature set advertised; Orthanc can’t seem to speak an appropriate implementation of DICOM that Onis will accept:

Log file from Orthanc showing Onis does not accept or understand its C-FIND/STORE methods implementation of DICOM

The root cause could be one or more issues; but not in our infrastructure at least. It’s clear that the C-FIND and should be the same for C-STORE command is documented in Onis 2.5 free edition as supported as we saw from the communication dialogue between the modalities.