Analyzing VOIP calls using tcpdump and Wireshark

If the asterisk is installed on Linux we can use tcpdump to capture packets and wireshark on windows to analyze calls.

Run following command on linux:

tcpdump -w trace.log -s 0

This stores all the network packets flow in trace.log file on linux server.

-w trace.log writes the output to the trace.log file

-s 0 specifies that the complete packets should be captured not only the headers. Note that 0 is zero not o (It looked like o to me). If this is missing, tcpdump will capture the SDP or RTP protocols but only SIP or UDP.

When finished stop the tcpdump using Ctrl-C and transfer the file to windows. In windows, open it with Wireshark and click on Statistics->Show Voip Calls

You can listen to the complete call as well see the diagram of how call was processed (including SIP signalling)

See:
http://www.panoramisk.com/151/analyzing-voip-with-wireshark/en/