wireshark capture filter unknown port sip

In the main window, one can find the capture filter just above the interfaces list and in the interfaces dialog. Display filters on the other hand do not have this limitation and you can change them on the fly. The latter are used to hide some packets from the packet list.Ĭapture filters are set before starting a packet capture and cannot be modified during the capture. The former are much more limited and are used to reduce the size of a raw packet capture.

But if you click Telephony->RTP->Show All Streams, then you'll see the RTP streams.Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port = 80). So, since all Wireshark en decode in your capture is RTP, without any VoIP signaling protocol, nothing shows up in the 'VOIP Calls' dialog. It guessed incorrectly in Amato_C's question, because those UDP packets are probably SRTP not RTP - unfortunately SRTP is almost indistinguishable from RTP - Wireshark would need to decode the SIP signaling's SDP to figure out the RTP is actually SRTP, but since SIP is running over TLS, it can't decode SIP. So basically Wireshark is guessing that the UDP packets are RTP - it happens to be guessing correctly in your case. You'll just see them as UDP packets with unknown data payload. If you disable that preference, you won't even see RTP packets. (in Edit->Preferences->Protocols->RTP) That preference setting makes Wireshark try to decode any/every UDP packet as an RTP packet using a heuristic, unless some other protocol matched the packet first.

The only reason you even see the RTP packets decoded as RTP is because you have the preference for RTP called ' Try to decode RTP outside of conversations' enabled. In your capture files, Wireshark cannot see the SIP signaling, because SIP is running over TLS, and is thus encrypted. The problem is the VOIP Calls feature analyzes a VoIP call, meaning the the signaling (SIP, H.323, etc.) as well as the RTP media. It's not whether they're G.729, or G.711, or any codec.

Wireshark capture filter unknown port sip