In this video, I'm going to show you how to capture traffic, but in this example, it's going to be
voice over IP traffic.
In other words, we're going to capture traffic between virtual phones as shown here, as well as virtual
phones and physical phones.
I'm going to make calls between these two phones and then we're going to capture the traffic and then
replay the voice call and we're going to use Wireshark for that.
OK, so let's have a look at this
practically, here's an example,
I'm using GNS3 to run a virtual infrastructure.
I've got two PCs, PC 1 and PC 2.
These are Windows computers.
So here's PC 2, here's PC 1.
They are Windows 10 computers
and I'm running IP phones on these computers.
So these are older IP communicator phones.
Don't worry too much about the technical details of the phones.
Basically these allow me to make calls from one phone to the other.
So as an example, I can set up a call from one phone to the other, I'm getting a lot of feedback here
because these two phones are running on my single computer and you typically don't make a phone call
from one phone to another.
That's right next to each other.
So the audio is going round and round and round between these two phones.
But the point is, is that I can make a phone call and I'll be able to capture the voice traffic using
Wireshark.
I've also got a Cisco communications manager express router here.
That's the router that's setting up the calls between the phones.
Again, don't worry too much about this, typing
show run here allows me to see the running configuration of the router.
I've got a DHCP pool configured to allocate IP addresses to phones.
Scrolling down
you can see the telephony service, this is the part that actually allows phones to communicate with
the router.
Now, what I want to point out here is notice the IP address of the router and notice the port
number Port 2000 is the skinny protocol.
That is a controlled protocol that sets up communication between the phones and the router.
Basically, the router tells the phones about each other and sets up the call between the two phones
using this port number.
So to TCP Port 2000, I'll show you that in a moment
when we run Wireshark captures, you can see the first phone has this number.
This is the second phone's telephone number of various other telephone numbers configured here are details
of the IP phones.
So you can see Mac addresses and other information
but again, we're not going to worry too much about the Call Manager Express or Cisco Unified Communications
Manager Express router configuration.
This is just to try and give you a bit of background about what's going on, show ephone shows us that
we've got multiple phones.
So here's ephone 1.
It's registered.
It has this telephone number 1000, here's ephone 2, it's registered with the router.
This is the telephone number of the phone at the moment.
Neither phone is making a phone call.
So what I'm going to do is capture traffic on this link.
So right-click start capture, GNS3 makes it really easy to capture packets using Wireshark because
GNS3 has Wireshark integrated with it.
So I can specify that I want to capture Ethernet traffic on this link and click OK.
Wireshark starts automatically and as you can see here, I'm seeing a bunch of protocols like STP,
DTP, so that's spanning tree, this is dynamic trunking protocol.
This is EIGRP which is a routing protocol.
But what I could do is Folta for skinny, skinny client control protocol or SCCP, is the communication
protocol once again use between the phones and the router.
So notice skinny client control protocol.
You can see it's a TCP protocol.
This is a message from the router to a phone.
So the source code is 2000
going to a random port number.
Here's an example from the phone to the router, so notice source port is this destination
port is 2000.
This is the IP address of PC 2.
I've put these two PCs in different subnets in this topology
but so that you can see this notice IP config shows us that the IP address is 10.1.2.1.
Just make that a bit bigger.
So notice 10.1.2.1.
The IP address on this side is 10.1.1.1.
So notice 10.1.1.1, 10.1.2.1 the router
has IP address
10.1.1.254 so this is communication between PC 2 and the router.
Notice TCP is the protocol used at layer 4, so IP at layer 3 source and destination IP address TCP
at layer 4 we can see Source and Destination Port number, and this is the communication protocol between
the phones and the router.
OK, but that's probably not what you're interested in seeing.
You probably interested in seeing UDP traffic now here we see some other traffic, some Dropbox's
traffic, that's not really what I'm interested in.
I'm interested in seeing telephony traffic.
Now, when I go to telephony, VOIP calls in Wireshark.
At the moment, I don't see any voice calls, but when I make a call from one phone to the other.
So let's make a call
from 1001.
Let's make it a bit quieter to 1000, call is set up on this side I can answer the call and again, I'm going
to get the feedback.
Hello
Hello, this is David.
David Bombal, speaking.
A lot of echo, but strange that I'm talking to myself
but there you go, phone call from one phone to another.
Now, what I'll do is mute the lines so we don't get all that feedback, but there's a call set up between
the two phones.
In Wireshark, telephony VoIP calls allows me to see that this is an active call, what I'll do now
is end the call.
So notice the call is ended and back in Wireshark.
Telephony VoIP calls notice the call is completed, so skinny call from 1001 to 1000, so Wireshark
is picking up that there was a call taking place on the network.
Scrolling down, I see the UDP traffic, I see media, independent network transport, it's got it listed
as mint, but this is actually incorrect.
This is an incorrect classification.
I know this is a call from this IP address to this IP address because
VoIP calls tells me that I can see the IP address involved in the call, so I've got these two phones
talking to each other.
So what I'm going to do and this is the trick, right
click decode as and don't use mint in this example, we're going to use RTP.
So scrolling right down RTP real time protocol.
I want to decode this traffic as RTP traffic and notice the difference.
I can see that this is G7-11 Eulo, G7-11 is a codec used for encoding analog voice.
When I'm speaking, this is an analog waveform, so I'm sending a voice into the air and that's an analog
waveform in the air.
So in this example, the IP phone, not the iPhone, but the IP phone is taking my analog voice, which
is sent through the air and encoding it as 0s and 1s
and that uses what's called a codec.
We have a coder, de-codec, codec.
The codec used here is G7-11.
We have G7-11
ulaw notice the u or alaw, ulaw is what you use in the USA
alaw I like to remember is all of us.
So that's not entirely true.
It's people like me in the UK.
We would generally use a law when making calls on a traditional telephony network like through British
Telecom.
But this is IP, these are Cisco IP phones, so they use ulaw by default.
So G7-11 ulaw.
There are different codecs such as G7-29, G 7-22.
There are other codecs.
But in this example, this is the codec that we're using.
Now, you may not be interested in all of that detail, but notice here we've got real-time transport
protocol.
We can see the payload once again, notice G 7-11
but probably what you want to do is the following.
Go to telephony, go to RTP, RTP streams
and notice here, we can see the source and destination streams now in Voice-Over-IP on Cisco phones as
an example, they are two uni directional streams for a two way conversation.
So if I'm talking to you and you're talking to me, there's a unidirectional stream for me to you, and
then a different one from you to me, two different streams
and that's why we see it as two streams here when troubleshooting voice-over-IP.
As an example, you often need to troubleshoot one-way voice
and the reason it's one way voice is because there are two unidirectional streams.
If there's a firewall as an example, blocking your voice, getting to me, you'll be able to hear me
but I won't be able to hear you again
you need directional.
So I'm going to select those two streams and I'm going to click analyze.
So here's the output of that we can see as an example forward and reverse calls and we get information
such as the maximum jitter, which is the variable delay in a voice call.
If your jitters too high the voice quality degrades dramatically a whole bunch of information
but what I want to do here is click play streams
and now what I'll be able to do is play the audio stream.
And again, I'm going to get the feedback.
Hello, this is David almost speaking.
A lot of echo a bit strange that I'm talking to myself.
So notice there are two streams here.
We've got two separate streams.
The blue one is from phone 2 to phone 1.
The gray one is from phone 1 to phone 2, hence getting a lot of replay.
What I could do is just select one of the streams and click on the.
So what I've got here is one stream only rather than two.
Again, I'm going to get the feedback.
Hello
Hello, this is David Bombal speaking.
So notice I am able to grab the audio stream off the wire and then replay it.
I can replay both streams.
It's a bit weird here because I'm talking to myself and there's only one person in the conversation.
But what I could do is do another one.
Let's actually do it in the reverse direction, so I don't make a call now from 1000 to 100
1.
Answer that testing
this is called 2
a lot of feedback.
What I could do is disable
the mike that disables the feedback
unmute that
David talking to himself.
I'll end the call.
So scrolling down.
You'll see the same UDP traffic again now going to telephony VoIP calls noticed they are two separate
calls now, two separate calls.
What I'm going to do now is do another capture, my wireshark crashed, so let's see
if we can capture another voice call.
So I'm going to filter for UDP again.
And what I'll do in this example is make a call from 1000 to 1001.
This is my second call.
David Bombal speaking to himself
end the local because of the feedback the call is ended.
So back in Wireshark Telephony VoIP calls, we can see the call here, so we can see there's a VoIP call
and then what I'll do is go to RTP, RTP streams.
That's not picking it up because once again, I need to decode this traffic as RTP and not mint, so
RTP,
click OK, G7-11 ulaw telephony RTP, RTP streams.
We can see G7-11 ulaw click analyze.
Click play streams, and there's our voice call.
This is my second call.
David Bombal speaking to himself.
OK, so there you go.
What I'll do at this point, actually, is save my capture so that you've got it.
So I'll go back into gns3 because otherwise it doesn't work properly.
Stop capture.
File save
and I'll say save RTP second call.
OK, so there's an example of capturing voice over IP calls between two phones using Wireshark.
Now, GNS3 makes us easy because I can simply capture on different links in the topology.
In the real world, you would have to either use span.
So span port or mirror a port if you want to use that term or inject a hub or another device into the network
so that you can see the traffic.
It does make this a lot easier because we don't have to worry with physical connections.
We don't have to try and span ports.
We can see the traffic very easily in this GNS3 topology.
OK, but now let's look at physical phones.
Can we capture voiceover IP calls between a physical phone and a virtual phone?
Let's try and do that.