Ethereal-users: RE: [Ethereal-users] Tethereal - using capture filters for SIP ca lls

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Francisco Alcoba (TS/EEM)" <francisco.alcoba@xxxxxxxxxxxx>
Date: Mon, 25 Apr 2005 15:48:21 +0200
Title: Tethereal - using capture filters for SIP calls
Hi,
 
Ethereal has a feature to do that -under Statistics, VoIP calls-. Tethereal has no equivalent, though, so you'll need to know in advance the data on which to filter. Something like:
 
  sip.from.addr == "sip:alice@xxxxxxx"
 
will filter on the from address. Bear in mind this is a display filter, not a capture one. And yes, it will affect the server performance, but how much is hard to say. In fact, to do that tethereal will need to dissect every single packet, not only SIP ones. If you are using a fixed UDP/TCP port, you might want to combine a port-based capture filter with the display one.
 
Best regards,
 
  Francisco
-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx]
Sent: lunes, 25 de abril de 2005 14:01
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Tethereal - using capture filters for SIP calls

Anyone:

I am using tethereal for troubleshooting SIP calls. As there are loads of UDP/SIP calls coming from the same IP, I would like to capture with some filter in order to isolate the call I want to see.

I believe the best way is to filter at SIP level and capture only those packets containig a specific text string (the calling or called number for example) in the SIP headers. This will do.

Q1: how can I do this?

Q2: will it affect the performane of the Server as tethereal need to open every SIP packet?

Regards,
Juan

**********************************************************************

Information transmitted in this message is intended only for the person or entity to which it is addressed and may contain

confidential and/or privileged material. If you are not the addressee you may not copy or deliver this message to anyone and

you should destroy this message and kindly notify the sender by reply email.

Opinions and other information in this message that do not relate to the official business of the company shall be understood

as neither given nor endorsed by it.

We do not accept liability for any viruses that may be transmitted in or with this message or attachments.

Unless specifically stated otherwise in this e-mail, this e-mail and the information contained in it or

attached to it shall not create any binding contractual relationship between the recipient or any other

party and Interoute.

Further information about the group is available from our website at www.interoute.com.

**********************************************************************