How to Listen to Phone Calls in Wireshark

Ғылым және технология

In this video I demonstrate how to listen to RTP voice streams in Wireshark. I cover how to pick a good capture point on the network, then how to select and listen to the audio stream.
Sample capture can be found here under 'SIP and RTP':
wiki.wireshark.org/SampleCapt...

Пікірлер: 138

  • @royalcanadianbearforce9841
    @royalcanadianbearforce98413 ай бұрын

    I was thinking of setting up VOIP this year for the home office. Perfect timing! This should be very fun to mess around with in the lab! Thank you very much for the informative video!

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    You should!

  • @mathewrtaylor
    @mathewrtaylor3 ай бұрын

    Incredible, thanks for the demo!

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    You’re welcome!

  • @bnk28zfp
    @bnk28zfp3 ай бұрын

    wow amazing example love your channel!!!!!!🎉🎉

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Thanks!

  • @mogan336
    @mogan336Ай бұрын

    This is gonna be fun!!!

  • @paxdriver
    @paxdriver3 ай бұрын

    Wireshark should definitely match rtp streams whenever it notices pairs like that. The window is already found under "telephony", it's not a stretch to presume auto-highlighting pairs of streams would be useful lol

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Oh agreed 100%

  • @davraheal6606
    @davraheal6606Ай бұрын

    Seriously cool bro

  • @parikshitkumar6485
    @parikshitkumar6485Ай бұрын

    You are real pro...interesting

  • @jrodrig9212
    @jrodrig92123 ай бұрын

    Really good video

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Thanks!

  • @aliabiyev1553
    @aliabiyev15533 ай бұрын

    Wow. Thank you so much.. 👍

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    You are so welcome!

  • @kapilsinghyadav5836
    @kapilsinghyadav58363 ай бұрын

    Amazing video sir 👍 support from India 😀

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Thank you!

  • @Anonymoussecure001

    @Anonymoussecure001

    2 ай бұрын

    ​@@plaintextpackets big fan sir love from India 🇮🇳 😊❤❤❤

  • @KrappyPatty-ry6lj
    @KrappyPatty-ry6lj3 ай бұрын

    Sick stuff, im subbing. You think you could do a Wireshark101 series? That would be very helpful.

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    I’m thinking about it! I’m getting better at the production stuff so makes it easier to fit in videos in my spare time

  • @roberto4898
    @roberto48982 ай бұрын

    Juan is still trying to find which one are they testing

  • @MrZANE42
    @MrZANE423 ай бұрын

    Would a capture of managed switch port mirror would work also, or would you just get one side of the data? A mirror of a port that one of the parties is connected to of course

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Yes this would work if you mirror the actual access port connected to one of the PCs. If you mirror a port at the distribution or core layers you may miss one direction.

  • @user-oc5cs1xn2y
    @user-oc5cs1xn2y3 ай бұрын

    Cooool 🎉🎉🎉

  • @suwenhao9864
    @suwenhao9864Ай бұрын

    Hi,sir . I’ve get two tiny questions. Is the SBC in my window pc primarily or I should download one? And sir you click the “telephony-RTP-RTP Streams” to find the streams instead of using filter Protocol==RTP , how could understand “RTP”, is something in protocol or it is protocol itself?🤔️ Thanks so much ,

  • @user-fu9ho3bg5z
    @user-fu9ho3bg5z3 ай бұрын

    cool videos more plz

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Sure!

  • @alisufyan6784
    @alisufyan67843 ай бұрын

    Thumbs Up

  • @umarmuslim8685
    @umarmuslim86853 ай бұрын

    please do you have a CCNA videos?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    I did my CCNA years ago and would probably fail now 😅

  • @eviconvidoesmerime9971
    @eviconvidoesmerime99712 ай бұрын

    How do I intercept other user not necessary my own conversation , but communication with party in the same network with me

  • @TheTrueCBaer
    @TheTrueCBaer3 ай бұрын

    A few years ago I had to set up an analog fax over VoIP. I had trouble getting It working (turned out to be delay, echo and telephone port impedance). Is there a way that Wireshark can decode analog modulated data over VoIP like fax and modems?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    That’s a good question, I believe you’d have to use like a VoIP converter to capture the traffic which would defeat the point

  • @TheTrueCBaer

    @TheTrueCBaer

    3 ай бұрын

    @@plaintextpackets The ATA used was a Grandstream HT-801. Here in Germany a huge number of fax machines are still in service. Even after the landline and ISDN networks are almost completely phased out. Mostly the ISP provided routers have ATAs integrated, some even have S0 ports for ISDN like the Fritzbox 7590. These devices are mostly plug and play. That makes the use of telephones and fax machines pretty easy. And yes an analog piece of paper digitized by a fax machine which then modulates an analog audio signal into and ATA which converts it to digital VoIP sends it over the internet and then everything in reverse sounds stupid. But the fax system has some qualities that modern IT still lacks. When i debugged it I used Wireshark to export the audio from the RTP stream and used an obscure tool (forgot the name) to debug the fax handshake.

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Yeah if you can get the RTP portion of it then you can at least see if it is a handshake problem. But if the analog piece has signal quality issues you won't necessarily see that

  • @fabiantoro7146
    @fabiantoro71463 ай бұрын

    Wow, well done! Fantastic demonstration. In fact I can understand the conversation because that's my native language lol. Following the invitation at the end of your video, I had an issue a few weeks back and I captured the packets. The problem was at the other end but I'd like to understand who was sending a reset. How could I upload the pcap file? Long story short: we couldn't send emails just to a specific domain

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Thank you Fabian! If you'd like to send in a file, you can do so here: www.dropbox.com/request/eB1ZFDicpOJ5nnft5eSp I would be happy to provide the analysis for free, with the condition that I can present the findings on the channel. Let me know!

  • @fabiantoro7146

    @fabiantoro7146

    3 ай бұрын

    Thank you @@plaintextpackets! I just uploaded the file. Unfortunately many packets are size limited because I didn't configure monitor capture properly on the switch. I hope it contains enough information

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    No problem. Is there a specific conversation you’re focusing on (source Ip / destination Ip), timestamp or protocol?

  • @fabiantoro7146

    @fabiantoro7146

    3 ай бұрын

    @@plaintextpackets so sorry. I just realized I sent the unfiltered conversation. In a couple of minutes I will upload just the filtered packets

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    @fabiantoro7146 check out my latest video, I reviewed your problem!

  • @joshuamcnair8762
    @joshuamcnair87623 ай бұрын

    How would you get wireshark to sniff the traffic of another device? In this case the router or middleman device?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    From the router: the router would either need to support packet capture via gui or a CLI tool like tcpdump. Some modern or small business routers have this capability, most enterprise ones do as well. If you’re somewhat advanced you can look up how to turn an old Linux box or a raspberry pi into a Linux network tap. That would allow you to capture the traffic by placing the tap between your router and PC. There are professional taps but they are $$$&.

  • @elaceaceak2357
    @elaceaceak23572 ай бұрын

    What types of call does this work with ? WhatsApp is encrypted right ? And so are normal calls (non wifi) So what kind of calls does this work on ?

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    RTP is used by voip phones in large enterprises, schools, hospitals, etc

  • @mohdabduljameel1184
    @mohdabduljameel11843 ай бұрын

    How can we capture the same packet with our pc? Without using any existing files can you please show it live, That you are capturing RTP etc etc

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    I’ll post a video on this soon.

  • @howtodefeatgangstalking
    @howtodefeatgangstalking3 ай бұрын

    What if the pdrson uses a vpn then you cant decrypt the traffic correct?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    That’s correct if they are using a VPN you will see those packets and not RTP, eg IPSEC or TLS, etc

  • @James_Knott

    @James_Knott

    3 ай бұрын

    @@plaintextpackets In fact, that's what happens if you try to capture WiFi calling cell phone calls (I've tried). WiFi calling is VoIP encrypted with IPSec.

  • @mrjakob853
    @mrjakob8534 күн бұрын

    Do you have another channel where I can follow you? Discord, Reddit?

  • @plaintextpackets

    @plaintextpackets

    4 күн бұрын

    Discord! Check the description

  • @rootcode
    @rootcode3 күн бұрын

    wow

  • @ogidarmatena
    @ogidarmatena3 ай бұрын

    I want to try

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Sure!

  • @paradownload2051
    @paradownload20513 ай бұрын

    Ip phone only? Viber call?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Yes this will only work with ip phones using RTP

  • @KevinK3vin0
    @KevinK3vin03 ай бұрын

    Does the device need to be connected to same network as the pc ?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    As shown in the video this only works if you are capturing from the PC where the call is taking place. If you want to sniff the traffic from another PC you need to do something like ARP poisoning

  • @KevinK3vin0

    @KevinK3vin0

    3 ай бұрын

    @@plaintextpackets so I won't be able to hear any phone calls made on smartphones?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Nope

  • @joelxcore
    @joelxcore10 күн бұрын

    Whats the best way to defend against this? SRTP, TLS?

  • @plaintextpackets

    @plaintextpackets

    7 күн бұрын

    Any sort of encrypted voice protocol. Many web-based voice apps are encrypted.

  • @icdlight9284
    @icdlight92843 ай бұрын

    Can a vpn app or other apps perform this since it is connected in ?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Can you restate the question?

  • @icdlight9284

    @icdlight9284

    3 ай бұрын

    ​@@plaintextpackets if i install a vpn application and since it is connected to my network can they do such things as you did in my network

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    If the vpn client is installed on your PC then no they won’t be able to see the traffic. This is why you should use VPN when in public networks like airports or coffee shops

  • @gunmanwhy657
    @gunmanwhy6573 ай бұрын

    How can I contact with you brother?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    plaintextpackets@gmail.com

  • @gunmanwhy657

    @gunmanwhy657

    3 ай бұрын

    @@plaintextpackets you don't have telegram for easy contact brother?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    No unfortunately I don't

  • @gunmanwhy657

    @gunmanwhy657

    3 ай бұрын

    @@plaintextpackets brother I have sent you message

  • @user-yy2wp9ys6d
    @user-yy2wp9ys6d3 ай бұрын

    In order to determine if the target is using rtp we would type rtp in wireshark right

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Yep you can use ‘rtp’ as your display filter

  • @user-yy2wp9ys6d

    @user-yy2wp9ys6d

    3 ай бұрын

    @@plaintextpackets would this work against the text now app how would we do that

  • @coolorphans
    @coolorphans3 ай бұрын

    Wow who designed your thumbnail?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Dall-E 😁

  • @darkphantom_01

    @darkphantom_01

    3 ай бұрын

    Ai

  • @procrastinatingrn3936

    @procrastinatingrn3936

    7 күн бұрын

    Ai

  • @noviccen388
    @noviccen3883 ай бұрын

    is it not enceypted at all? what about whatsapp calls?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    RTP traffic is generally unencrypted within networks (companies, school campuses, etc). If exchanged over the internet or insecure networks vendors are likely to use encryption. WhatsApp uses its own proprietary protocol which is encrypted

  • @user-ih9vm9cm5n

    @user-ih9vm9cm5n

    3 ай бұрын

    Whatsapp is end-to-end encrypted from user a to user b. But in realty you can’t trust nobody . It’s a question about time. They stored NOW our data in hope that one day when the encrypt key ist locked up they can’t see what is written befor. All what we write and all what we say is in the end all zero and one . In the future when quantum computer encrypt from today some standard encrypt methods is it easy to go back and lock what is written befor.

  • @karim6514

    @karim6514

    3 ай бұрын

    I believe WhatsApp uses the same encryption as Signal

  • @Pokedollar

    @Pokedollar

    3 ай бұрын

    ​@@karim6514Well, they claim to use it. They say they use the signal-protocol, but since Signal is Open source, they are free to temper with that as they wish

  • @Pokedollar

    @Pokedollar

    3 ай бұрын

    But yes, it's end to end encrypted

  • @samadel.a765
    @samadel.a7652 ай бұрын

    00:53 I heard it as "and you should cease to exist💀"

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    Lool

  • @potcleanx7693
    @potcleanx76933 ай бұрын

    what kind of call is this?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Digital voice call using the RTP protocol

  • @palois8407
    @palois84073 ай бұрын

    Im trying to set these up for companies.... All of the good ones to monitor calls for better customre service 😂😂

  • @lilcuddles203
    @lilcuddles2033 ай бұрын

    skip to 4:27

  • @addisonbentley9037
    @addisonbentley90373 ай бұрын

    Can this be used as a method of parental controls?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    It could if your kids were using VoIP, but you would need to capture their traffic continuously and store it somewhere. We do it at the Enterprise level but it is costly.

  • @mohamad.A
    @mohamad.A3 ай бұрын

    why when i open RTP streams its not showing anything?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    You may not have RTP packets present in the capture.

  • @mohamad.A

    @mohamad.A

    2 ай бұрын

    @@plaintextpackets dose it work on whatsapp and Instagram voice calls?

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    Nope

  • @Rundik
    @Rundik2 ай бұрын

    For educational purposes only wink wink

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    To be really good in networking and security you need to know how to break things

  • @AmitJaiswal-sm4bi
    @AmitJaiswal-sm4bi3 ай бұрын

    Do we need external hardware to capture?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    No you can capture from Wireshark or tcpdump if you have access to the pc. I will make a video showing how in the near future

  • @rabbiyatabassum2278

    @rabbiyatabassum2278

    2 ай бұрын

    will wait for that video@@plaintextpackets

  • @CheckpointEngineer
    @CheckpointEngineer2 ай бұрын

    Please give me a example that a PC to PC call means which application they use for conversation and is there any dedicated device required to take the captured and later analysis using Wireshark.??

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    I will do a part 2 to this video

  • @All.Rights.Stolen
    @All.Rights.Stolen3 ай бұрын

    i know thats isp and even any intellgence can capture my phone call on any network or host .. doesnt matter ...😐😐 😊

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    👀

  • @GjentiG4
    @GjentiG43 ай бұрын

    Would this work for discord?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    Unfortunately no, Discord uses an encrypted audio codec: discord.com/developers/docs/topics/voice-connections

  • @skeeterford2617
    @skeeterford2617Ай бұрын

    I’m new at wire shark so do you use wireshark

  • @Itshacksmith
    @Itshacksmith11 күн бұрын

    Can we sniff volte packets too 😊

  • @Megasteel32
    @Megasteel323 ай бұрын

    how bout you demonstrate not using AI for your thumbnails

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    I have no art skills!

  • @rashidbinzaiyed7149
    @rashidbinzaiyed71493 ай бұрын

    Can I listen to normal calls of mobile phones? Like Android to Android, iPhone to iPhone, Android to iPhone or telephone etc?

  • @plaintextpackets

    @plaintextpackets

    3 ай бұрын

    No, cellular voice calls from modern cellphones are all encrypted

  • @rashidbinzaiyed7149

    @rashidbinzaiyed7149

    3 ай бұрын

    @@plaintextpackets is there any way to listen to them without touching or hacking the target phone? Because I'm in urgent need of that, (some family issues has to be solved with solid evidence) any way to crack the encryption?

  • @xfy123

    @xfy123

    2 ай бұрын

    ​@@rashidbinzaiyed7149you would need a setup to capture the data and depending if it's a 3/4/5g connection a good amount of time to brute force the encryption. It's doable but it takes time and if you are caught you will probably spend a few years in prison.

  • @user-fl2ym8tm1m

    @user-fl2ym8tm1m

    Ай бұрын

    @@rashidbinzaiyed7149 rashid XDD ofc indian guy rofl

  • @MrXtahsee
    @MrXtahsee2 ай бұрын

    Great vid. New sub, you have discord channel?

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    Thanks! No but good suggestion I’ll make one soon

  • @plaintextpackets

    @plaintextpackets

    2 ай бұрын

    discord.gg/QgAnHXke @MrXtahsee

  • @a.q118
    @a.q118Ай бұрын

    shhhhhhhhhhhhet

Келесі