[SIPForum-discussion] Wireshark and Prepare Filter Option

[Zuñiga, Guillermo]

Not, I didn't use any Expresion to get the IP Signaling, I did it with the Prepare Filter Option from VoIP Calls from the huge file.

But here the only different that I can see with the call without filter is that the rtp duration is equal to cero(0.000s),

[cid:image001.jpg at 01CB589F.845CF500]

De: Banda, Srinivas [mailto:sbanda at sonusnet.com]
Enviado el: lunes, 20 de septiembre de 2010 07:39 a.m.
Para: Zuñiga, Guillermo; discussion at sipforum.org
Asunto: RE: [SIPForum-discussion] Wireshark and Prepare Filter Option

Hi,

You might have filtered the call based on the signaling IP, But RTP will be flowing through media IP in SDP, that is the reason u r not able to see RTP in u r small file.

Regards
Srinivas

________________________________
From: discussion-bounces at sipforum.org [mailto:discussion-bounces at sipforum.org] On Behalf Of Zuñiga, Guillermo
Sent: Saturday, September 18, 2010 4:27 AM
To: Zuñiga, Guillermo; discussion at sipforum.org
Subject: Re: [SIPForum-discussion] Wireshark and Prepare Filter Option

Any comments related this fellows?
Someone have had this issue.?

Regards
I will appreciate your comments.
Guillermo

De: Zuñiga, Guillermo
Enviado el: jueves, 16 de septiembre de 2010 01:57 a.m.
Para: discussion at sipforum.org
Asunto: Wireshark and Prepare Filter Option

Hi Fellows.
I have the following question:
A.
I am doing a test using codec g711 and I am doing a trace using wireshark.
After I make my traces I get a huge file with all the calls that are through my system, and then
I go to the Tab Optiont statistics-VoIP calls and here I find my test Call and go to the Option
Player->Decode-> and there I can Check the Litle Box with the RTP Packets and then choose Play
and then I can here the Voice.

Like I said before it was using the huge file with all the calls and all the packets that I did in my trace.

B.
My second way to do that is going to
-statistics-VoIP calls
-Find my Test Call.
-Here use the Option "Prepare Filter" and with this just get my Test Call and save to a very small File.
 ---The issue here is when I do that I "Can not"  here the RTP(voice) like when I make with the huge File
without use the Prepare Filter Option.
----When I make the Graph of the test call I can see all the RTP packets, but all said Duration=0(cero).

Why Could this happened? This is a issue with Wireshark, Prepare Filter and Decode Option?

I will appreciate a lot your help.
Regards
Guillermo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://sipforum.org/pipermail/discussion/attachments/20100920/d2a64d53/attachment-0002.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 31463 bytes
Desc: image001.jpg
URL: <http://sipforum.org/pipermail/discussion/attachments/20100920/d2a64d53/attachment-0002.jpg>