[Guy Harris <gharris@xxxxxxxxx>]

Ali Mohammad wrote:

> With Ethereal I capture the real time traffic of voip calls through the net
> but I am asked to display just a few voip-relevant steps. These should
> be the ones showing the following protocols in the "Protocol" column:
> SIP, SDP and DNS. How can I get the ethereal filter to show me (display)
> just these protocols when I start capturing the real time traffic during
> the procedure of a VoIP call.

If you want to capture all the traffic, but display only those 
protocols, see Jaap Keuter's reply.

If you only want to *capture* SIP and DNS traffic (SDP would be 
transported inside SIP), you'd have to know the TCP or UDP port number 
that will be used for SIP, and use that in a capture filter ("tcp port 
N" or "udp port N" or "port N" for TCP or UDP).