Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 122 views

    Wire Shark Debug

    Uploaded by

    Anonymous GEyA5Ir
    This document provides instructions for using Wireshark to analyze VoIP calls captured from an Asterisk server. It describes: 1) Using tcpdump commands to capture SIP and RTP packets from the server; 2) Opening the captured packets in Wireshark; 3) Locating specific calls by viewing the VoIP Calls statistics; 4) Graphing SIP messages to debug call issues; 5) Listening to call audio to check quality; and 6) Analyzing RTP streams to view packet details like jitter and delay. The goal is to debug issues with calls and better understand quality problems by examining the packet capture in Wireshark.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Wire Shark Debug

    Uploaded by

    Anonymous GEyA5Ir
    122 views5 pages
    This document provides instructions for using Wireshark to analyze VoIP calls captured from an Asterisk server. It describes: 1) Using tcpdump commands to capture SIP and RTP packets from the server; 2) Opening the captured packets in Wireshark; 3) Locating specific calls by viewing the VoIP Calls statistics; 4) Graphing SIP messages to debug call issues; 5) Listening to call audio to check quality; and 6) Analyzing RTP streams to view packet details like jitter and delay. The goal is to debug issues with calls and better understand quality problems by examining the packet capture in Wireshark.

    Original Description:

    Wire Shark Debug

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides instructions for using Wireshark to analyze VoIP calls captured from an Asterisk server. It describes: 1) Using tcpdump commands to capture SIP and RTP packets from the server; 2) Opening the captured packets in Wireshark; 3) Locating specific calls by viewing the VoIP Calls statistics; 4) Graphing SIP messages to debug call issues; 5) Listening to call audio to check quality; and 6) Analyzing RTP streams to view packet details like jitter and delay. The goal is to debug issues with calls and better understand quality problems by examining the packet capture in Wireshark.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    122 views5 pages

    Wire Shark Debug

    Uploaded by

    Anonymous GEyA5Ir
    This document provides instructions for using Wireshark to analyze VoIP calls captured from an Asterisk server. It describes: 1) Using tcpdump commands to capture SIP and RTP packets from the server; 2) Opening the captured packets in Wireshark; 3) Locating specific calls by viewing the VoIP Calls statistics; 4) Graphing SIP messages to debug call issues; 5) Listening to call audio to check quality; and 6) Analyzing RTP streams to view packet details like jitter and delay. The goal is to debug issues with calls and better understand quality problems by examining the packet capture in Wireshark.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 5

    WireShark VoIP debugging

    This is a simple how-to fro getting packets from an Asterisk server and into wireshark
    and then looking at what it has to show you.
    We will look at :1.
    2.
    3.
    4.
    5.
    6.

    Getting the packets out of Asterisk.


    Opening wireshark and initial screen
    Locating calls.
    Graphing the Sip messages
    Listening to the Call
    Looking at the RTP stream

    1. Getting the packets we want.


    First things first we need to get the packets we want. This is far simpler than its
    thought. We use a simple command line tool called tcpdump, if its not installed install it
    now, You wont be able to live without it.
    Here we have 2 commands, The first captures packets on interface eth0, -n means we
    wont converts addresses, -w means we just capture raw packets and udp means its
    only the udp packets we want and finally port 5060 means its only the sip messaging
    we want. In the second we dont specify port 5060 so that we get the rtp stream.
    /usr/sbin/tcpdump -n -i eth0 -w /tmp/wireshark.pcap -s2000 udp port 5060
    /usr/sbin/tcpdump -n -i eth0 -w /tmp/wireshark.pcap -s2000 udp
    Once you have started the capture and made a call as required you will get a file called
    for example /tmp/wireshark.pcap copy this to your workstation via ftp or sftp as you
    would copy any file.
    2. Wireshark
    Wireshark is avalible for Linux, Windows and most other OS's. You can use it to make
    live captures from your workstation or as we are going to do oprn pcap files from
    elsewhere.

    On starting Wireshark open your Pcap file and you should get a screen as above. We
    can see in the protocol column both SIP and RTP packets but we want to isolate our
    call.

    3. Locating calls
    Too locate our call we click on statistics then on Voip Calls and not as you might expect
    SIP. Sip will show you a count of each sip message in the capture.
    By selecting VoIP call you will get a new window as shown here.

    This will show all calls in the capture and their status.
    4. Graphing the calls
    We can then highlight the call we want and by clicking on graph we get a visual
    representation of the SIP messages as below.

    Here we can trace the messaging of the call and debug any issues we have.
    This can then be saved as an ASCII version.
    5. Listening to the Audio
    Also in the VoIP calls screen there is a player button. On clicking this you get a screen
    as below showing both legs of the call and its possible to play both separately or
    together.

    This is very useful for listening to audio from calls as well as for inband DTMF issues.
    Audio quality is subjective and by being able to listen to each leg of a call you can see
    if its poor in both directions or just one.
    6.

    Looking at the RTP stream

    Another option on the Statistics menu is RTP option. Click this and then click RTP
    streams. This will open a window as below.

    In this window it does show some headline staistics for the call to see more detail
    select the stream you want to look at and click on analyze. This opens a new window

    that shows the data packet by packet as below.

    As you can see its possible here to track the jitter and delta/delay full details of whats
    here is at http://wiki.wireshark.org/RTP_statistics?highlight=(RTP)

    Conclusion
    We can see that its possible to get a lot of information about calls from a simple
    capture, and armed with the output debugging issues will be much simpler and in the
    case of quality issues easier to put forward to the users.
    The wireshark wiki is at http://wiki.wireshark.org/FrontPage and has all you need to
    know.

    You might also like