This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

MATE display filter for SIP calls

0

Hi,

I've deployed a MATE configuration file to filter SIP signalling + media. Using the filter: mate.session.callid == "mycallid" I only get SIP signalling but no media. I can get SIP+media with the following filter only: mate.session.media_port == "myport". Is it possible to fix the configuration file to get media filtering by call-id?

Pdu sip_pdu Proto sip Transport udp/ip {
Extract callid From sip.Call-ID;
Extract from From sip.from.user;
Extract to From sip.to.user;
Extract method From sip.Method;
Extract cseq_method From sip.CSeq.method;
Extract media_addr From sdp.connection_info.address;
Extract media_port From sdp.media.port;
};
Gop sip_ses On sip_pdu Match (callid) {
Start(method="INVITE");
Stop(cseq_method="BYE");
Extra (callid, from, to, media_port);
};

Pdu udp_pdu Proto udp Transport ip { Extract media_addr From ip.addr; Extract media_port From udp.port; }; Gop udp_ses On udp_pdu Match (media_port, media_port) { Extra (media_port); };

Pdu tcp_pdu Proto tcp Transport ip { Extract media_addr From ip.addr; Extract media_port From tcp.port; Extract tcp_start From tcp.flags.syn; Extract tcp_stop From tcp.flags.fin; }; Gop tcp_ses On tcp_pdu Match (media_port, media_port) { Start (tcp_start=1); Stop (tcp_stop=1); Extra (media_port); };

Gog session { Member sip_ses (media_port); Member udp_ses (media_port); Member tcp_ses (media_port); Extra (callid, from, to); }; Done;

Thanks!

asked 23 Nov ‘12, 00:26

Robin's gravatar image

Robin
6225
accept rate: 0%

edited 26 Nov ‘12, 04:32

Hi,

Did you manage to resolve this issue ?

Thanks in anticipation

(13 Sep ‘15, 20:07) sshark