This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm running a monitor session on a Cisco 7609, source gi1/1 to destination gi 1/13. My computer is connected to int gi1/13. I want to capture SIP messaging from this interface but can't see it. I get DHCP, UDP, etc packets, but no SIP. What am I doing wrong

asked 12 May, 06:19

blangham's gravatar image

blangham
6112
accept rate: 0%


Many SIP implementations use UDP/5060 but it is possible the SIP you are trying to capture is using a non-standard port. SIP can also run over TCP (typically only used in enterprises, and even then seldom) or TLS. If it's in TLS you won't be able to decode it unless you can get the keys.

Do you have a trace???

permanent link

answered 12 May, 06:31

dbAtAffirmed's gravatar image

dbAtAffirmed
6113
accept rate: 0%

This ended up being a NIC card issue. My PC has a Realtek PCIe Gbe Family controller. My laptop has Broadcom NetLink Gigabit. There must be some settings int the Realtek that need changed to pass this traffic.

(15 May, 07:27) blangham
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×3

question asked: 12 May, 06:19

question was seen: 334 times

last updated: 15 May, 07:27

p​o​w​e​r​e​d by O​S​Q​A