On Friday 07 January 2022 at 22:33:31, David Villasmil wrote:
yeah, if you're using tshark, something like:
tshark -f "host [GATEWAY-IP]" -i any
will show you anything going/coming from that ip address.
you can also install sngrep, which is a fantastic cli tool. it's in debian's repos. You start it with "sngrep -c" to show only [c]alls
I would also advocate doing both. 1. Install sngrep, and if you don't already have them, tshark and/or tcpdump 2. Use tshark (or tcpdump) to capture SIP traffic (which normally means "anything on port 5060, in either direction"), so: tshark -f "port 5060" -i any -w capturefile.pcap 3. Then you can use sngrep to read the file which tshark created, and at your leisure, scroll through the traffic and try to understand what happened when: sngrep -I capturefile.pcap sngrep is a splendid tool, but SIP is not a simple protocol, so having a capture file you can go back to later, whenever you want to, and understand a bit more about it (or answer other people's questions if they ask "well, what was the response to this, then?") is very useful. Antony. -- Some things the German language doesn't easily distinguish between: - slugs and snails - cucumbers and gherkins - snakes and queues - wearing something, or carrying it - mothers and nuts - driving a car, riding a bicycle, or travelling by train - a man and a husband - a woman and a wife - changing clothes and moving house - pockets and bags Please reply to the list; please *don't* CC me.