Advanced Wireshark SIP filters

When looking for SIP traffic in Wireshark, you can start with the Display Filter sip. Here are a couple more specific filters.

To find a specific type of SIP packet:

sip.CSeq.method==REGISTER

Sometimes you need to match registration traffic on the server and client (two Wireshark sessions). To see matching traffic, in a SIP Message Header, find a Call-ID on one side, then use a display filter like this on both the server side and client side:

sip.Call-ID=="[email protected]"

It may be helpful to combine several filters:

ip.addr = 162.39.14.21 and sip.CSeq.method==REGISTER and sip.from.user==120

1 thought on “Advanced Wireshark SIP filters

Leave a Reply

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.