Tracing packets - asterisk issues
freebsd at qeng-ho.org
Tue Jan 25 11:33:32 UTC 2011
On 01/25/11 10:41, Da Rock wrote:
> On 01/25/11 18:46, Bruce Ferrell wrote:
>> On 01/24/2011 11:13 PM, Da Rock wrote:
>>> I have been trying to get some pointers on my asterisk issues and I've
>>> only been hearing crickets chirping (Asterisk list and here). I need a
>>> pointer or two so I can fix this issue, so I'll try another angle.
>>> How do I trace IP packets across the network (pf firewall included)?
>>> And would it be possible to read it visually (human readable)?
>> Use tcpdump to do a capture file. something like this:
>> tcpdump -i eth0 -n -s 1500 -w sip.cap
>> then feed sip.cap to wireshark
>> filter for SIP and observe the SIP conversation
>> It's also possible to decode the RTP stream
> I've been using tcpdump on the asterisk server and both interfaces of
> the firewall as well as the log interface. Unfortunately, its not giving
> me the answers I want so far. Follow a stream from beginning to end, so
> to speak, but I've been having trouble matching it up; especially with
> the log.
> Is it possible with wireshark to do this kind of matching if I capture
> on all these interfaces?
From the wireshark manual page:
Merge another capture file to the currently loaded one. The
File:Merge dialog box allows the merge "Prepended",
"Chronologically" or "Appended", relative to the already
Looks like doing a chronological merge is what you need. Your machines
had better have the same idea of what the time is though.
More information about the freebsd-questions