If you want to capture just the RTP stream(s), if you could creat a capture
filter to capture only UDP packets that are 214 bytes, that will get G.711
packets. There is a slight chance you might get some stuff you do not want
though. You still have to "decode as RTP" though.
Signaling is a bit tougher since the packet sizes vary.
-----Original Message-----
From: Guy Harris
To: hecvillaf@xxxxxxxxx
Cc: ethereal-users@xxxxxxxxxxxx
Sent: 5/14/02 7:13 PM
Subject: Re: [Ethereal-users] Voip sniffing
On Tue, May 14, 2002 at 06:32:40PM -0700, hecvillaf@xxxxxxxxx wrote:
> Really? So, there is no way of sniffing VoIP?
That depends on what you mean by "sniffing VoIP".
If you mean "there is no way to have a capture filter that will capture
*only* VoIP traffic", that's true, unless you already know, in advance,
what TCP and UDP ports the VoIP traffic will be using.
You *might* be able to use Tethereal in the fashion I described, using a
*display* filter to discard non-VoIP packets.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users
