[LARTC] how to classify sip traffic (voip)

[Alessandro O. Ungaro]

Fabian,

on IP/UDP header you have the Length field, you can try to match this.

Regards,

Alessandro Ungaro
x-arnie

Fabian Gervan wrote:
> How i can classify sip traffic (voip)??  
> 
> I try dst 5060 udp port, but dont'work. sip sesion use dynamic port.
> 
> Sniffing packets with windows net-peeker, I see that packets lenghts
> is always=87
> How i can filter, by  packet lenght, with u32?
> 
> Regards
> Fabian
> _______________________________________________
> LARTC mailing list
> LARTC at mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
>