can not see SIP protocol in my wireshark

asked 2021-10-12 19:26:28 +0000

arq gravatar image

updated 2021-10-13 03:50:29 +0000

When opening a file with SIP messages, my wireshark does not display the SIP messages. SIP is listed in enabled protocols.

file link: https://drive.google.com/drive/folder...

edit retag flag offensive close merge delete

Comments

There is not enough information available to determine what the issue is. There could be many causes (traffic is on a "protected" Wi-Fi network so Wireshark would need the password to encrypt it, the traffic is on a non-standard port, the traffic is over TLS etc.), so we'd have to see the capture file to answer the question.

Guy Harris gravatar imageGuy Harris ( 2021-10-12 21:11:03 +0000 )edit

Thanks Gary for your comment. Actually it is not a problem with capture, it is an issue with my display. When I am opening a file with SIP messages, it does not display them as separate SIP protocol messages, it is showing within TCP. not sure how can I attach a file here. When I try to attach, it says >60 points required.

arq gravatar imagearq ( 2021-10-12 23:10:30 +0000 )edit

Put the capture file on a public share (Google, Dropbox, OneDrive, ...) then update your question with a link to the file.

Chuckc gravatar imageChuckc ( 2021-10-12 23:48:56 +0000 )edit

Here is the link to pcap file - it should be accessible. Thanks https://drive.google.com/drive/folder...

arq gravatar imagearq ( 2021-10-13 03:19:55 +0000 )edit

Capture file indeed looks fine, showing SIP messages. Can you go and select a different profile in Wireshark and see what changes.

Jaap gravatar imageJaap ( 2021-10-13 05:57:14 +0000 )edit
see more comments