Voipmonitor.org is the BOMB! It does all of this plus analyzes the pcap for you. 9 times out of 10 you don't even have to touch the pcap. It's saved my team 100's of hours of the past 12 month. I literally cannot say enough nice things about it. dw On Tue, Mar 24, 2015 at 10:47 AM, Nelson Hicks <nelsonh at socket.net> wrote:

I'm looking for options to capture SIP/RTP traffic, index it by call, and make it easy to download the capture for a specific call based on calling/called and time. I want the capture to remain ongoing (rotating capture) with, say, a 96 hour window of calls available. I'm open to hardware and software options.

Right now, I have a server that uses tshark running rotating 1-minute captures, but finding and extracting an individual call out of each of the packet segments and merging them together is a slower and more manual process than I'd like, and I'd like to get our techs direct access to these captures as well.

Thanks,

-- Nelson Hicks Network Operations SOCKET (573) 817-0000 ext. 210 nelsonh at socket.net

_______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

-- [image: Ringfree Communications, Inc] <http://ringfree.biz/> David Wessell / President 828-575-0030 x101/ david at ringfree.biz Ringfree Communications, Inc Office: 828-575-0030 / Fax: 888-243-7830 PO BOX 1994 Hendersonville, NC 28793 http://ringfree.biz This e-mail message may contain confidential or legally privileged information and is intended only for the use of the intended recipient(s). Any unauthorized disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Company Name is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've found that sngrep works great for finding calls and other SIP traffic inside packet captures. I'm not sure if it'll handle that many packet captures, but I've never tested it. Thank you, Michael Englehorn On 3/24/2015 9:47 AM, Nelson Hicks wrote:

I'm looking for options to capture SIP/RTP traffic, index it by call, and make it easy to download the capture for a specific call based on calling/called and time. I want the capture to remain ongoing (rotating capture) with, say, a 96 hour window of calls available. I'm open to hardware and software options.

Right now, I have a server that uses tshark running rotating 1-minute captures, but finding and extracting an individual call out of each of the packet segments and merging them together is a slower and more manual process than I'd like, and I'd like to get our techs direct access to these captures as well.

Thanks,

-- Nelson Hicks Network Operations SOCKET (573) 817-0000 ext. 210 nelsonh at socket.net <mailto:nelsonh at socket.net>

_______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBAgAGBQJVEXngAAoJELn0PzaYIQ6g+LMP/2oe054fydcovj4h3GY+Mvvb +ZKwGYMZDZzY24oprzzbKsQS7mBaNdH6fMV8pu5zoia0aAi91k6CuM+dMVrqe6dh b6/1veRv/SK2MOVHRcD9wLlybc3tP23EOZ5Sw1ii0tIyIKQp3wym6AWllRFsHYYa vlMESIn0mRqq7CfE2tbu558kgQtME2ucXvr2fpM2O71fpdvPj/3KB05frL6AaAJC /vRnRt+QFzMSD57ZGy/h5zh0zSNMT5IIglfhrz3/NFsDiaYM6aFMoqYZYuf2TOIA EQFPK+Nn3P1kG8k/vB1w8Ac5ojcpRba88VviaeQyW2TsoroDNTemEVWVyiLNXTEi zaqmuWbl++H0rGgDtfkm1rPbH9hV9qCO2K7LvzUasA+4LYCUqkgHLKzbx+ZwxE1+ pI1yqGR+3nj78KJFgGNDXRjviCICEf4X68e1sJv20xkLCJEZ7LqJSDR9UsxNTXaf 1T8AwztJqrE+4SfXIMjdod0yYi8PxbLJ4SnT/55NdPAL8oBrKmcPueDV6AwdunjA DfBGXrnFMyAw4FkaWA7/C6MOZ5N7APVSGzXxTGoKE2Q/RDK+1widVrUVJ1v9BvOT n85vYDLwK9ssb3fy1iF395XGfpWvyXMkQm4C2ANuRg4FxdUYmbL4PtYUqdyxpBig 40SFH9CAmg08WO+SGFh+ =6dc1 -----END PGP SIGNATURE-----

Nelson, Homer is a great open source tool for basic troubleshooting. Pcapture, which is the commercial version of it, can provide additional functionality. Google both. There is plenty of information online. Regards, Brad Anouar On Mar 24, 2015 7:47 AM, "Nelson Hicks" <nelsonh at socket.net> wrote:

I'm looking for options to capture SIP/RTP traffic, index it by call, and make it easy to download the capture for a specific call based on calling/called and time. I want the capture to remain ongoing (rotating capture) with, say, a 96 hour window of calls available. I'm open to hardware and software options.

Right now, I have a server that uses tshark running rotating 1-minute captures, but finding and extracting an individual call out of each of the packet segments and merging them together is a slower and more manual process than I'd like, and I'd like to get our techs direct access to these captures as well.

Thanks,

-- Nelson Hicks Network Operations SOCKET (573) 817-0000 ext. 210 nelsonh at socket.net

_______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

VoIPMonitor has been great for us as well. -- Jason Park From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Nelson Hicks Sent: Tuesday, March 24, 2015 9:47 AM To: voiceops at voiceops.org Subject: [VoiceOps] SIP packet capture with index I'm looking for options to capture SIP/RTP traffic, index it by call, and make it easy to download the capture for a specific call based on calling/called and time. I want the capture to remain ongoing (rotating capture) with, say, a 96 hour window of calls available. I'm open to hardware and software options. Right now, I have a server that uses tshark running rotating 1-minute captures, but finding and extracting an individual call out of each of the packet segments and merging them together is a slower and more manual process than I'd like, and I'd like to get our techs direct access to these captures as well. Thanks, -- Nelson Hicks Network Operations SOCKET (573) 817-0000 ext. 210 nelsonh at socket.net<mailto:nelsonh at socket.net>

We capture 100% of our SIP traffic using tcpdump and logging 14 files at 100MB per file (1.5GB rough usage). We have at least a few days worth of SIP packets to review if necessary. Use tshark to find sets of connected data. This command line does all the rotation and capture for us: /usr/sbin/tcpdump -qpni eth0 -s 65535 -C 100 -W 14 -Z root -w /var/log/sip.pcap port 5060 -q Quick (quiet?) output. Print less protocol information so output lines are shorter. -p Don?t put the interface into promiscuous mode. -n Don?t convert host addresses to names. -i Interface (eth0 here) -s Snarf snaplen bytes of data from each packet rather than the default of 68. -C Magic Sauce. Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number after it, starting at 1 and continuing upward. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes). -W Used in conjunction with the -C option, this will limit the number of files created to the specified number, and begin overwriting files from the beginning, thus creating a ?rotating? buffer. In addition, it will name the files with enough leading 0s to support the maximum number of files, allowing them to sort correctly. -Z Drops privileges (if root) and changes user ID to user and the group ID to the primary group of user. This behavior is enabled by default (-Z pcap), and can be disabled by -Z root. -w Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ??-??. On Tue, 24 Mar 2015, Nelson Hicks wrote:

I'm looking for options to capture SIP/RTP traffic, index it by call, and make it easy to download the capture for a specific call based on calling/called and time. I want the capture to remain ongoing (rotating capture) with, say, a 96 hour window of calls available. I'm open to hardware and software options.

Right now, I have a server that uses tshark running rotating 1-minute captures, but finding and extracting an individual call out of each of the packet segments and merging them together is a slower and more manual process than I'd like, and I'd like to get our techs direct access to these captures as well.

Thanks,

-- Nelson Hicks Network Operations SOCKET (573) 817-0000 ext. 210 nelsonh at socket.net

--------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------