Dear ASI Rakhi Saini,
Regarding your query on the Wireshark mailing list, please note that WhatsApp uses end-to-end encryption and routes its voice and video calls through its own centralized servers or via TURN/STUN servers depending on the connection type. Because of this architecture, Wireshark packet capture on a local laptop cannot directly reveal or isolate the individual target's personal IP address during a WhatsApp call. Packet analysis will only show encrypted traffic or WhatsApp's server IP addresses, not the direct peer IP in standard scenarios. For official investigations involving WhatsApp traffic, standard packet inspection tools like Wireshark are insufficient; formal legal requests or production orders must be submitted directly to Meta's law enforcement response channels.
Sir/Madam,
Most respectfully, it is submitted that I have recently used Wireshark on my laptop for the purpose of network traffic analysis during investigation of a cyber crime case. During testing and analysis of IP traffic related to WhatsApp calling, it was observed that the IP address associated with WhatsApp calls could not be identified/detected through Wireshark as expected. Due to this technical issue, the investigation has been adversely affected, and it has become difficult to identify and trace the alleged/accused person.
In view of the above facts and circumstances, it is requested that the matter may kindly be examined by the concerned technical team and necessary guidance/technical clarification may be provided regarding the proper method of identifying relevant IP traffic associated with WhatsApp calls through Wireshark, at the earliest.
Your prompt assistance in this regard will be highly appreciated.
Thanking you.
Yours faithfully,
Investigating Officer
ASI Rakhi Saini
Wireshark-users mailing list -- wireshark-users@xxxxxxxxxxxxx
To unsubscribe send an email to wireshark-users-leave@xxxxxxxxxxxxx