Hi, I need to trace one call between two media gateways in mobile core network (H.248 and sigtran). Can this be done with wireshark? if yes, how can I do this? Thanks in advance. asked 05 Feb '11, 14:23  jorgferr |
One Answer:
Presuming you work for the telco in question, just arrange for a port-mirror/SPAN to a port on a switch in the transit path and capture to a locally connected wireshark enabled PC. (If you have a switch that supports remote capture you might be able to use that facility as well). answered 05 Feb '11, 16:29  martyvis |
Thanks for the answer. But in the media gateways passes several calls and I need to trace just one (to measure some parameters). Is it possible to filter in wireshark just to catch one call?
To just catch one call e.g have a capture filter catching a single call is impossible I'd say, it might be possible to filter out one call using display filter. But even that is not so easy and requires a bit of manual work as there is nothing in MEGACO/H.248 that ties the signals to a subscriber number or something similar.