Lab User
Profile Logout

FREE Lab: Create a Free account to run this lab! Create Account in < 1 min

Filtering Advanced: VoIP

tshark-basics | Level: Intermediate  | Total Lab Runs: 0 | Free Lab | 


User Avatar
 
Lab Scoreboard

Lab Walkthrough Video:


VoIP (Voice over IP) based telephony is ubiquitous today in Enterprise environments. In this exercise, you will learn how to begin VoIP traffic analysis using tshark. We also have a course on VoIP Traffic Analysis on Pentester Academy if you are new to the topic.

Start the lab, locate the PCAP file in the current directory and use tshark to answer the following:

Questions:

Set A:

    1. What command can be used to only show VoIP traffic?
    2. What command can be used to print all REGISTER packets?
    3. What command can be used to only print the source IP, sender extension and authorization digest response for REGISTER packets?
    4. What command can be used to print all codecs being used by RTP protocol?


    Set B:

    1. What is the IP address of the user who is using the Zoiper VoIP client?
    2. What is the IP address of the SIP server used to place calls?
    3. What is the content of the text message sent to +918108591527?
    4. Which extensions completed a call successfully?

    Here are some hints:

    Set A:

      1. Protocol based filters are very popular. Research about them.
      2. Each packet type is identified using a specific field value in the packet.
      3. Filter for the specific type of packets and then print specific fields.
      4. Session Description Protocol (SDP) is used to negotiate and exchange information for a session. 


      Set B:

      1. There is a field in VoIP traffic which is just like the user agent of HTTP traffic.
      2. Before placing call, each VoIP client device has to register its extension with the server. Keep an eye for such packets. 
      3. Can we search for strings? Yes. Can we read encrypted traffic? Yes. Is a text message complex media needed to carry on RTP? No.
      4. What we say to other side of call before disconnecting? May be the SIP protocol also uses something similar or same.

      The following activities are strictly prohibited on this website unless otherwise explicitly stated as allowed in the mission statement:

      • Using automated scanners
      • Using brute force attacks
      • Denial of Service attacks
      • Attacking other student machines in challenges where you might achieve a shell on the vulnerable system
      • Attacking the lab infrastructure

      Users violating the above will be either temporarily or permanently banned from the website. 

      If you are unsure about an activity, then please contact support to confirm that it is allowed on our website.

      Technical Support for this Lab:

      There is a reason we provide unlimited lab time: you can take as much time as you need to solve a lab. However, we realize that sometimes hints might be necessary to keep you motivated!

      We currently provide technical support limited to:

      • Giving hints for a lab exercise
      • In rare circumstances, if you have totally given up (NO!!!) then tell you how to solve it. This will be limited to sharing the solution video or lab report
      • A lab exercise fails to load or has errors in it

      If you need technical support, please email  attackdefense@pentesteracademy.com  clearly mention the name and link of the lab exercise and other essential details. The more descriptive you are, the faster we can help you. We will get back to you within 24 hours or less. 

      For adminitrative queries, billing, enterprise accounts etc. please email feedback@binarysecuritysolutions.com