Wireshark · Ethereal-users: Re: [Ethereal-users] How to use Tethereal to decode SIP/SDP infomation

[phu@xxxxxxxxxxxx]

> I'm desiring the following result from Tethreal:
>
> --------------from:
> http://www.voip-info.org/tiki-index.php?page=Asterisk%20phone%20grandstream%20budgetone
>  ------------
>
> Here is a partial tethereal output:
>
> Frame 2 (453 bytes on wire, 453 bytes captured)
> Ethernet II, Src: 00:0c:6e:01:db:01, Dst: 00:0b:82:00:a8:f1
> Internet Protocol, Src Addr: 192.168.233.66, Dst Addr: 192.168.233.67
> User Datagram Protocol, Src Port: 5060 (5060), Dst Port: 5060 (5060)
> Session Initiation Protocol
>    Status-Line: SIP/2.0 484 Address Incomplete
>        Status-Code: 484
>    Message Header
>        Via: SIP/2.0/UDP 192.168.233.67;branch=z9hG4bK0000000000000000
> From: "Holger Schurig"
> <sip:grandstream1@192.168.233.66>;tag=0000000000000000
>            SIP from address: "Holger Schurig"
> <sip:grandstream1@192.168.233.66>
>            SIP tag: 0000000000000000
>        To: <sip:2@192.168.233.66>;tag=as32424689
>            SIP to address: <sip:2@192.168.233.66>
>            SIP tag: as32424689
>        Call-ID: 0000000000000000@192.168.233.67
>        CSeq: 46598 INVITE
>        User-Agent: Asterisk PBX
>        Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER
>        Contact: <sip:2@192.168.233.66:0>
>        Content-Length: 0
>
> Frame 3 (512 bytes on wire, 512 bytes captured)
> Ethernet II, Src: 00:0b:82:00:a8:f1, Dst: 00:0c:6e:01:db:01
> Internet Protocol, Src Addr: 192.168.233.67, Dst Addr: 192.168.233.66
> User Datagram Protocol, Src Port: 5060 (5060), Dst Port: 0 (0)
>
> --------------------------
>
> Could you help me? Thank you very much!!!
>
> Paul
>
>> Hi, kind guys:
>>
>> I need to trace SIP/SDP infomation using Tethereal on Linux remote
>> terminal. The following command line can trace UDP infomation:
>>
>>  tethereal -V host 192.168.221.56 && port 5060 udp
>>
>> But it just shows UDP layer info. How can I use Tethereal command line
>> to trace SIP/SDP layer information?
>>
>> Kindly looking forward to your helps!!!!!!!!!!!
>>
>> Paul
>>
>>
>>
>> _______________________________________________
>> Ethereal-users mailing list
>> Ethereal-users@xxxxxxxxxxxx
>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users


Thanks for your response, I got it:

Remove "udp" from the end of the line, To decode SIP using tethereal, 
simply enter this command:

tethereal -Vi <YOUR_INTERFACE_NAME> port 5060 (or: and host hostname)

Thanks

paul