VoIP analysis

In this section, we'll take a look at how SIP works when a connection is created between two phones, and how RTP works to transmit the live data between the two.

The example capture that we'll use for this chapter and the next one is available on the Wireshark SampleCaptures page (https://wiki.wireshark.org/SampleCaptures). If you scroll down and look for the SIP and RTP section, we'll be using the MagicJack+ short test call:

Download MagicJack+ short test call and open it in Wireshark.

Once you have that open, we'll take a look at our capture and notice that we have a variety of packets; it has not been yet been cleaned up:

We can see that there's some ARP, some UDP traffic, ICMP, some SIP, and some RTP; we also have some SMB in the end. So there's a mixture of stuff; this is like a real capture. In order to pick out just the SIP traffic, which is one of the many protocols but the most common protocol to use for VoIP, we simply enter sip for our display filter and apply it:

There...