July 2017
Intermediate to advanced
434 pages
12h 59m
English
When you ask for help in Real Time Telecommunication you will often (always?) be asked to provide a "pcap" file of your network traffic including the problematic session. Also, you will often want to remotely save the traffic in a file that you will later analyze (with sngrep or wireshark, etc).
The tcpdump utility is almost guaranteed to be available on any kind of operating system. Its most basic usage (save all the traffic sniffed by the Ethernet interface) is:
tcpdump -nq -s 0 -i eth0 -w /tmp/dump.pcap
You can filter what you save to only packets incoming and outbound from/to port 5060 (no protocol specified, so both TCP and UDP, full "traditional" SIP signaling):
tcpdump -nq -s 0 -i eth0 ...
Read now
Unlock full access