This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to analyze some voip traffic in Wireshark. But all I could see are small UDP packets; some containing RTP streams and I can see various codec information like G.711, G.723 etc. But there is no sign of SIP or any other signaling packets. Is it possible to hide SIP or H323 signalling within UDP packets in a way which are undetectable to Wireshark? or STUN can do some encoding to hide signalling packets?

asked 25 Sep '13, 09:38

rousseau's gravatar image

rousseau
1112
accept rate: 0%

edited 25 Sep '13, 10:14


Is it possible to hide SIP or H323 signalling within UDP packets in a way which are undetectable to Wireshark?

the easiest way to "hide" SIP messages from Wireshark is to use a non-standard port, as Wireshark detects SIP basically by its ports (5060 and 5061 for secure SIP).

You can change (extend) the ports

Edit -> Preferences -> Protocols -> SIP -> SIP TCP Ports / SIP TLS Ports

However, you will have to know the port then. One way would be to search for string typically contained in SIP messages.

frame contains "INVITE"

or

frame contains "REGISTER"

However, this will only work for unencrypted SIP. In the case of encrypted SIP, you'll have to wade through the traffic manually to figure out the port.

BTW: If there is no SIP/H.323 traffic in you capture file, it may well be missing, because it was not recorded in the first place ;-))

Regards
Kurt

permanent link

answered 29 Sep '13, 09:33

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×109
×11
×8

question asked: 25 Sep '13, 09:38

question was seen: 3,776 times

last updated: 29 Sep '13, 09:33

p​o​w​e​r​e​d by O​S​Q​A