How does one capture H.323 voice traffic on a VOIP network?

views:

211

answers:

How does one capture H.323 voice traffic on a VOIP network?

What I am trying to do is capture the WAV data of a phone conversation on a VOIP network using SharpPCap/PCap.Net.

We are using the H.323 recommendation and my understanding is that voice data is located in the RTP packets. However, there is no way to heuristically determine if a UDP packet is a RTP packet, so we have to do more work before we can capture the data.

The H.323 recommendation apparently uses a lot of traffic on specific TCP ports to negotiate the call before the WAV data is sent via RTP. However, I am having very little luck determining what data is actually sent on those TCP ports, when it is sent, what the packets look like, how to handle it, etc.

If anyone has any information on how to go about this I'd really appreciate it. My Google-Fu seems to be failing me on this one.

+3 A:

Wireshark is your friend... I imagine it still has a plugin that will allow you to select a VoIP stream and then save to file. The fun part will be if you are using a switched network.

Wireshark + VoIP

Matthew Whited 2010-06-02 15:37:20

I am sorry. I must not be making myself clear. I do not want to use Wireshark. I need to actually write software that performs this task of saving the WAV files of these phone conversations. I do not see how Wireshark helps me in this regard. Am I misunderstanding your suggestion?

Chris Holmes 2010-06-02 20:15:44

Well wireshark is open source so I'm sure you can find what you need in there. Also the protocol decoding is in wireshark as well. (And you could even use the packet data to decode the packets yourself.) The problem with most VoIP is it will be UDP on a switched network. Rather difficult to sniff off the wire.

Matthew Whited 2010-06-02 20:33:37

you have to parse h.323 OLC message from both sides then you will be able to know what pakets to capture

Boris 2010-06-15 18:07:53

Thanks Boris. I think I'm going about it differently, but I think what I am doing is going to work. Right now I am able to detect the RTCP packet via the header (packet type, 2nd byte) and then look for the SDES. The SDES will have the CNAME, and that gives me the unique phone. I also can then get the SSRC and start grabbing all the RTP packets with the same SSRC. Hopefully that allows me to do what I want and capture the WAV data. Haven't finished it yet. We'll see.

Chris Holmes 2010-06-16 13:33:56

ansaurus

tags:

views:

answers:

How does one capture H.323 voice traffic on a VOIP network?

related questions