When telephone business grew, Private Branch eXchanges (PBX) were designed, and deployed in office settings to provide the increasing of telephone lines and to connect internal callers (over trunk lines) through either the PSTN or eventually to destination callers. Initially, the PSTN was a simple one-to-one telephone line connecting phones from one room to another. Initially, the most basic analog network service, called POTS (Plain Old Telephone Service), used a pair of twisted copper wires in order to connect a residential phone to a central office from where a residential customer can dial out in the PSTN. It is easy to tell where the packet begins and ends.įor me, the downside is that I would have to learn a new language (not the worst thing in the world).ĮDIT: Looks like the SIP dissector in wireshark/tshark can help quite a bit if you use the Lua script approach for instance, you can inspect sip.response-request on a SIP response to find the packet number of matching request.The Public Switched Telephone Network (PSTN) is a global system of interconnected, various analog sized phone networks which provides users the capability to carry voice conversations with each other.You automatically have access to the parsed SIP message.

An example to help you get started can be found here under the example 'Dump VoIP calls into separate files' (or similarly here on Google Code). This is certainly doable, but I wanted you to know what you are getting into.Īn alternative to a separate process (that I have no experience with) is to write a Wireshark script in Lua, and invoke that via tshark -Xlua_script:my_a (using a version of tshark compiled with Lua support).

The process will need to understand the SIP protocol well enough to determine when calls are confirmed, terminated, etc.

This process will need to store selected info from these packets (such as From, To, Start Time, etc.) and correlate this info across packets based on dialog identifiers.This process will need to detect packet boundaries, since the input will have multiple lines per packet. Pipe this to a process that will extract info from each packet.Have tshark to display the full details of the SIP packets (e.g., with -v).You can do this by post-processing the output from tshark, but it will be a fair amount of work. I don't know of any way to coax tshark to give you what the Wireshark GUI does.

Voip wireshark pcap