Wireshark SIP and RTP Capture

[dsm600rr]

Definitely new to Wireshark - trying to mess around with it and having no luck.

When I select my interface I can see all sorts of traffic.

When I try and apply filter: sip or rtp, nothing shows up in the trace.

When I try ip.addr==192.168.1.251&&sip (PBX on Data VLAN) - nothing shows up either.

I have my desk phones (J179) on 172.30.20.1 (Voice VLAN)

I have my Soft Phones (IX Workplace) on: 192.168.1.251 (Data VLAN)

When I have the default filters applied, I can see my IX Workplace IP Address in the trace. Thoughts?

ACSS

 

[derfloh]

Probably you are using encrypted communication (SIP over TLS).

Wireshark is not able to detect those packets as SIP so that he filters won't fit.

You can use 'tcp.port == 5061' but you will not see any useful information.

You are better watching the SIP trace with system monitor.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[dsm600rr]

derfloh: Yes my IX Workplace is using TLS however we also have a SIP Trunk. Weird nothing would show up.

ACSS

 

[derfloh]

Does it use default ports?

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN