 | 1 | initial version |
My general suggestion is to get closer to the source of the traffic and follow it from there. In this case, it sounds like you are trying to capture phone traffic. I would recommend that you set up a port mirror that copies the traffic coming to and from the port the phone is connected. Once you've got that running, start a phone call, speak a few words then hang up. In Wireshark filter for the IP address of the phone to see if you captured any data. I wouldn't rely on filtering by protocol when first getting started as many times you will exclude data that you don't realize you need - start with the IP.
Once you find the traffic you're looking for on the switch port mirror then you'll need to see where that data goes from there to find where it gets lost.
