RE: [Ethereal-users] Sniffing Just VOIP traffic

["Patrick T. McAlister" <patrick@xxxxxxxxxxxxx>]

Thank you. 



Depends on what you mean for VOIP traffic.

Signalling only or Signalling and Media? Both

in regard to signalling which (set of) protocol(s)?
   - SIP ?
   - H323 ?
   - BICC ?
   - MGCP ?
  -  other?
All Of them

if you are to capture media you need to capture all UDP traffic as
there's no way to know beforehand which udp.port RTP is going to use.

If you need to *display* voip signalling only the filter
    sip || h225 || h245 || q931 || mgcp || bicc
should be enough.

in order to filter in capture you need to know which ports these
protocols are using and set you capture filter accordingly.

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users