Capture filter bug? - SIP “udp port 5060” is not working with IP-IP-Encapsulation RFC2003

Question

I have an Session Border Controller which can use IP-in-IP encapsulation (RFC 2003) to send all sip data for example to a capture machine.

On that machine I have a wireshark to make SIP traces. It seems capture filter "udp port 5060" is not working. Could it cause by IP-IP encapsulation?

These packets contians the following headers: -Ethernet -IP -IP -UDP -SIP

Is this a bug? I tried 1.6.5 and 1.6.7 too.

Thanks!

Answer 1

Yes, the IP-in-IP encapsulation is messing up your capture filter. BPF (the engine responsible for filtering) uses fixed offsets to look for things. You can see the way the filter works by using "tcpdump -d <filter>". When I do this for "udp port 5060", I get:

(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 12
(002) ldb      [23]
(003) jeq      #0x11            jt 4    jf 12
(004) ldh      [20]
(005) jset     #0x1fff          jt 12   jf 6
(006) ldxb     4*([14]&0xf)
(007) ldh      [x + 14]
(008) jeq      #0x13c4          jt 11   jf 9
(009) ldh      [x + 16]
(010) jeq      #0x13c4          jt 11   jf 12
(011) ret      #65535
(012) ret      #0

As BPF is not aware of IP-in-IP encapsulation, it will check for the value of 5060 (0x13c4) in the wrong place. This also happens when there is vlan tagging, but for vlan tagging, you can add the word "vlan" to your filter to make it correct the offsets. I don't think there is a similar keyword for IP-in-IP.

You can manually account for variable IP header lengths or you can make life easy and test for specific offsets (counting from 0 from the start of the outer IP header) by using:

ip[<offset>:2]==0x13c4 or ip[<offset+2>:2==0x13c4

Could you upload a small example capture file on www.cloudshark.org and post the link here, then we can assist you in building a proper capture filter.

Answer 2

1.) SIP is defined for UDP and TCP 5060. Maybe the clients use TCP in your case.

2.) Maybe they use SIP on a non-standard port

3.) Maybe SIP is encrypted, then it's port 5061

4.) Regarding IP-IP encapsulation, you need to give us a little bit more information (e.g. how do you send the data to a capture machine).

I suggest to check 1. - 3. first.

EDIT: If your sniffer really sees IP-in-IP packets, the answer of the following question might help you:

http://ask.wireshark.org/questions/9723/capture-an-ip-inside-a-gre-packet

Regards
Kurt