[LARTC] how to classify sip traffic (voip)

[Nathan Littlepage]

SIP uses 5060. What is hard is to classify is the RTP streams since they 
use pretty much any port. Its best to classify the SIP and RTP traffic 
at the endpoints and honor the labeled packets through the network.

Fabian Gervan wrote:
> How i can classify sip traffic (voip)??  
> 
> I try dst 5060 udp port, but dont'work. sip sesion use dynamic port.
> 
> Sniffing packets with windows net-peeker, I see that packets lenghts
> is always=87
> How i can filter, by  packet lenght, with u32?
> 
> Regards
> Fabian
> _______________________________________________
> LARTC mailing list
> LARTC at mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
>