Welcome back to INE's Wireshark Foundation
where we will continue learning about Wireshark
and in this module, we will discuss capturing VOIP or voice over IP.
So, what is voice over IP?
Voice over IP is the, the service that allows you
to enable voice communications over data networks.
It requires its own set of protocols and signaling methods.
There's codecs assigned. The layout is very different, you have gateways,
not your typical default gateway, but actual voice gateways.
And the whole entire system operates together
to provide you with the good call quality over a
pre-existing data network where as in the old days,
you'd use a typically an old PBX with analog
type of technology to talk on the telephone.
Now, you can hang a PC and a voice phone together
off a single switchboard with 2 VLAN's.
You could set up quality of service.
It can all talk to a unified communication system
and you can do advanced collaboration through your email
through jabber and so on and so forth.
But, there's a lot of things that can go wrong.
Obviously, what I like to tell people
was that if your data network is a garbage,
then it's likely that you're going to get garbage in, garbage out.
And what that means is obviously, you want to have the correct bandwidth or
optimize the network in every way that you can.
Have no port mismatches. Anyway that you can make sure that
the data network operates at an optimal level
and provides the performance that you need.
And then when you design to put voice on top of it,
you want to make sure that you consider
the overhead and exactly what it is that you're going to be deploying.
So that being said, common issues that you will see with VOIP,
you will have dropped calls.
You could have one-way calls where you can hear but you can't speak or vice versa.
Hair-pinning. You could have poor quality, you could have jitter.
Your QoS could be configured incorrectly or
in lieu of not having it, have problems because
you're trying to do a voice call and someone's sending a huge data transfer
over the network and causing poor performance.
So, that being said, Wireshark can help you capture this data
take a good look inside it and start to figure out what exactly is going on.
So, here we see a basic capture voice.
And some of the things that we can see in here, specific settings.
We can see SIP connections, sessions initiation protocol.
What that allows you to do is have your client and I have one here.
Allows you to use a SIP client to make a call directly in and allows you to establish
a phone connection. But in order to do that you have to make sure that
you're again, your network is performing optimally and so on and so forth.
So the tools that you can use to capture voice is obviously you can just a run a capture
and you could run your capture on a, and place your Wireshark instance correctly
so that you can perhaps, capture data leaving your phone or infront of a,
let's say, your server where you're actually taking the calls from.
You can place Wireshark and capture data and view on your capture window,
run some filters on it. You can do a flow graph.
And what I wanted to highlight specifically was the telephony menu
in the capture window which we have not really looked at until now because
this will only really become relevant once you start capturing voice data.
An obviously in the analyze menu,
you can use the Expert and other tools to help troubleshoot it.
So, as we mentioned before, SIP or the session initiation protocol,
allows you to initiate a VOIP call and we will be taking a look at that.
And the way that we can look at that is within Wireshark.
Again, once we've captured our data and we've tried to make a call with our SIP client,
we can go into telephony and we can look at voice calls.
And from in here, you will see specifically the calls trying.
You can see the state, so it's, they're trying to set up the call, or it's ringing
or maybe you'll see cancelled or rejected.
So there's certain information you can find here
once you start to drill down and really analyze the data which we will do in the next module.
So essentially, to capture VOIP,
you want to place Wireshark correctly.
You want to run your capture.
You want to make sure that you're capturing the correct data.
In this example, we had a SIP client and we tried to make a connection out to a provider.
We had a series of issues. In one instance, we put in the wrong credentials.
Different strings, we tried to create different issues here but essentially
we've gotten all the errors back where as you could see on the example here,
we were getting rejected.
So Wireshark can help you capture and isolate, and review VOIP traffics
so that you can troubleshoot it and analyze what could potentially be the problem.