<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Nick,<br>
<br>
No problem for this. You could do a live dump on remote server using
tcpdump over ssh.<br>
Something like :<br>
<ul>
<li>first: make a fifo with mkfifo /tmp/capture<br>
</li>
<li>ssh user@host tcpdump -i yourethinterface -U -s0 -w - 'udp
5060' > /tmp/capture (you could personalize the filter on
tcpdump delimited between ->'<- )</li>
<li>Open wireshark->Capture->Interface->Options</li>
<li>Mange Interface->new-> browse or digit directly the path
of the fifo begin created</li>
<li>Save</li>
<li>Start dumping & enjoy!</li>
</ul>
<p>If you have Signaling on a server and media on another one there
are no problem. You could dump signaling as described before, and
make another fifo and dump in the same way the media from the
other server.</p>
<p>On Wireshark side add both fifo interface (make sure that after
you have saved the interface you have both selected into the menu)
and start the live dump!<br>
</p>
<p>Maybe coul seem complicated, but you can automate all in a bash
script!<br>
</p>
<p>Khaled, sorry again!<br>
</p>
<p>BR<br>
Davide<br>
</p>
<br>
<div class="moz-cite-prefix">On 06/06/13 22:24, Nick Khamis wrote:<br>
</div>
<blockquote
cite="mid:CAGWRaZYFXTEx=r_SKvrYPL-YPypGSVkWgZ16f7VAx=L14c-w_g@mail.gmail.com"
type="cite">
<div dir="ltr">The problem is, wireshark is running on my
computer, but the voip traffic is on the servers, also within
the network. Khaled, sorry for the hijack!
<div><br>
</div>
<div style="">N.</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a>
<a class="moz-txt-link-freetext" href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">
</pre>
</body>
</html>