Date: Tue, 25 Jan 2011 11:33:30 +0000 From: Arthur Chance <freebsd@qeng-ho.org> To: Da Rock <freebsd-questions@herveybayaustralia.com.au> Cc: freebsd-questions@freebsd.org Subject: Re: Tracing packets - asterisk issues Message-ID: <4D3EB50A.5030803@qeng-ho.org> In-Reply-To: <4D3EA8C4.2030204@herveybayaustralia.com.au> References: <4D3E782F.5040203@herveybayaustralia.com.au> <4D3E8DCA.1020304@baywinds.org> <4D3EA8C4.2030204@herveybayaustralia.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On 01/25/11 10:41, Da Rock wrote:
> On 01/25/11 18:46, Bruce Ferrell wrote:
>> On 01/24/2011 11:13 PM, Da Rock wrote:
>>> I have been trying to get some pointers on my asterisk issues and I've
>>> only been hearing crickets chirping (Asterisk list and here). I need a
>>> pointer or two so I can fix this issue, so I'll try another angle.
>>>
>>> How do I trace IP packets across the network (pf firewall included)?
>>> And would it be possible to read it visually (human readable)?
>>>
>>> Cheers
>> Use tcpdump to do a capture file. something like this:
>>
>> tcpdump -i eth0 -n -s 1500 -w sip.cap
>>
>> then feed sip.cap to wireshark
>>
>> filter for SIP and observe the SIP conversation
>>
>> It's also possible to decode the RTP stream
> I've been using tcpdump on the asterisk server and both interfaces of
> the firewall as well as the log interface. Unfortunately, its not giving
> me the answers I want so far. Follow a stream from beginning to end, so
> to speak, but I've been having trouble matching it up; especially with
> the log.
>
> Is it possible with wireshark to do this kind of matching if I capture
> on all these interfaces?
From the wireshark manual page:
INTERFACE
MENU ITEMS
File:Open
File:Open Recent
File:Merge
Merge another capture file to the currently loaded one. The
File:Merge dialog box allows the merge "Prepended",
"Chronologically" or "Appended", relative to the already
loaded one.
Looks like doing a chronological merge is what you need. Your machines
had better have the same idea of what the time is though.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4D3EB50A.5030803>