Hi, I'm trying to apply a filter to capture only SIP traffic and running into an odd situation. When I leave wireshark with no capture filter, I see the packets I want to capture from host X to host Y on UDP port 5060. So I applied these filters on the capture options screen one by one: -port 5060 -udp port 5060 -host X All of them returned nothing. Is there something I'm missing here? |
My bet would be that the SIP traffic is vlan tagged (you can check this by looking closer to the unfiltered SIP traffic). If this is true, prepend your capture filters with "vlan and ..." so the filters will become:
Hope this helps. Aha! yes, they're tagged, didn't realize I had to add that to the filter. Thanks so much
(29 Sep '11, 10:02)
CulverTech
|