Sniffing VOIP with WiresharK

“VOIP is pretty secure.” How many of us have heard this before?

Let’s fire up wireshark (found here on Linux and windows, it is a network protocol analyzer that does some cool stuff, really easy!)

First, a little background into VOIP; we use essentially three types of protocols for VOIP: Management, Media, and Auxiliary. Essentially, when netwrkspider picks up his voip phone to call yurirat on his voip phone, netwrkspider first connects to a central management server which contacts yurirat’s management server, and they work out the connection details. (Protocols, etc.) H.323 and SIP are the protocols most used in this phase.

After negotiating the details of the connection, netwrkspider’s and yurirat’s phones connect directly–This is the second group of protocols–Usually using RIP, or something like it. The third groups of protocols are the auxiliary protocols: transport, etc Usually UDP is used, but TCP could be used if you really wanted it too. (Yes, it has error correction built in, but if it has to re-send a packet, a couple milli-seconds later, think about what that will do to a latency-sensitive application like VOIP–This is why the stateless protocol UDP is usually used)

So after our background into VOIP, let’s take a look at sniffing it. Wireshark can analyze the majority of the most-used VOIP protocols, and is very useful for troubleshooting issues with your VOIP implementation. Once we have captured a VOIP stream or two, we can have Wireshark search for VOIP Calls.

We can then select one of the streams and graph it, to get a better picture of how the call was actually made.

Next, we can exit out of that, and look for any RTP frames (remember, Real Time Protocol is the media protocol for the actual conversation itself) and do an analysis on it. Once the analysis comes up, we can select “Save Payload”, and have it extract the audio from the RTP stream and save it as an .au, to listen in the media player of your choice.

Wireshark is a very good tool to use for troubleshooting your VOIP network, as well as listening in to the occasional call; of course, this could be mitigated very easy by using something like IPsec in your lan.

"Netwrkspider"

ABHISEK KUMAR

( NETWORK ADMINISTRATOR/Programmer )