This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

We are having issue while analyzing SIP traffic on centos. Centos server is getting SIP traffic coming via a Switch/Mirror port.

I can see both way traffic when i use following command tethereal -i eth0

But i am unable to see incoming traffic when i use following command ethereal -i eth0 port 5060

This seems to happen just for SIP, because when i checked port 161 using below command. I can see both ways traffic tetheral -i eth0 port 161

Regards Farhan

asked 20 Feb '15, 04:13

farhan_ft's gravatar image

farhan_ft
0112
accept rate: 0%

edited 29 Mar '15, 19:02

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

and when i saved the output using -w option.

tethereal -i eth0 -w /tmp/trace.pcap

i can see incoming packets on port 5060...

(20 Feb '15, 04:17) farhan_ft

This is the Ask Wireshark website, Ethereal is obsolete and no longer supported.

What is your OS version?

(20 Feb '15, 04:44) grahamb ♦

You will be getting a lot of complaints about (t)ethereal being ancient. Never mind that, lets see if we can solve your problem.

(20 Feb '15, 04:46) Jaap ♦

Are there VLANs involved when you capture SIP traffic?

(20 Feb '15, 04:47) Jaap ♦

As i said i can see the traffic when i i saved the output using -w option. tethereal -i eth0 -w /tmp/trace.pcap

i can see incoming packets on port 5060... but when i use with PORT 5060. I can see only one way traffic. tethereal -i eth0.

centos1 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 GMT 2011 x86_64 x86_64 x86_64 GNU/Linux

(20 Feb '15, 04:57) farhan_ft

When i have opened the Captured trace using command "tethereal -i eth0 -w /tmp/trace.pcap" and selected the incoming packet i can see "protocols in frame eth:ethertype:vlan:ethertype:ip:udp:sip:sdp"

(20 Feb '15, 06:11) farhan_ft

@farhan_ft

Your "answers" have been converted to comments as that's how this site works. Please read the FAQ for more information.

(20 Feb '15, 06:24) grahamb ♦
showing 5 of 7 show 2 more comments

This looks like the often overlooked issue with VLAN tags. If present the capture filter has to be made aware of it, so that it can (and will) adjust the offset for subsequent field comparisons in the packet.

This expression could help you then:

"udp port 5060 or (vlan and udp port 5060)"
This means:

  1. Filter on UDP port 5060 (catches untagged frames)
  2. If present skip over the VLAN tag, or stop if not present
  3. Again filter on UDP port 5060 (in the tagged frame)
permanent link

answered 20 Feb '15, 06:51

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×69
×3

question asked: 20 Feb '15, 04:13

question was seen: 2,005 times

last updated: 29 Mar '15, 19:02

p​o​w​e​r​e​d by O​S​Q​A