This is our old Q&A Site. Please post any new questions and answers at

Hello, I only need to capture SIP packets. Would you please tell me how to configure Wireshark to accomplish this? It's better to use pictures to describe to me. Thanks.

This question is marked "community wiki".

asked 09 Jun '11, 04:40

Jacky%20Yeh's gravatar image

Jacky Yeh
accept rate: 0%

edited 09 Jun '11, 15:37

cmaynard's gravatar image

cmaynard ♦♦

I have tried the sip, udp, ip, port and ethernet as follows show. Only ethernet can capture SIP packets but this is not my wish. My wish is to use sip filter to capture all pure SIP packets. alt text

(09 Jun '11, 04:52) Jacky Yeh

Refer to the SIP wiki page.

permanent link

answered 09 Jun '11, 15:38

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

Dear Cmaynard, I mean how I can only capture SIP packets by wireshark? I have tried to configure the capture filter of the capture option but it's unavailable.

Jacky Yeh

(09 Jun '11, 22:16) Jacky Yeh

I don't understand what you mean by, "it's unavailable."

Maybe you're having trouble with capture filter syntax? Capture filter syntax is not the same as display filter syntax. Have a look at the Capture Filters wiki page; maybe that will help you.

(10 Jun '11, 13:03) cmaynard ♦♦

The SIP wiki link posted by @cmaynard states:

Capture Filter

You cannot directly filter SIP protocols while capturing. However, if you know the UDP or TCP or port used (see above), you can filter on that one.

(10 Jun '11, 16:52) helloworld

Usually SIP is on UDP port 5060 (though sometime TCP port 5060 is also use)

So just use "port 5060" in your capture filter, and the use "sip" in the display filter to filter out any non-SIP traffic that might be on that port

permanent link

answered 12 Jun '11, 05:16

martyvis's gravatar image

accept rate: 7%

Ok, I got it. Thanks so much.

Jacky Yeh

(12 Jun '11, 19:21) Jacky Yeh
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 09 Jun '11, 04:40

question was seen: 59,594 times

last updated: 09 Apr '14, 13:37

p​o​w​e​r​e​d by O​S​Q​A