[VoiceOps] Splitting SIP+RTP PCAP files

Brooks Bridges bbridges at ifbyphone.com
Wed Jun 23 13:07:56 EDT 2010

The utility was written by Alex as a replacement for pcapsipdump.
pcapsipdump suffers from severe performance and stability problems with any
appreciable traffic.


I can vouch that Alex's utility is very stable and efficient, but I do have
to take exception to the "inexpensive (read: basically free!)" statement, as
the utility is wholly owned (as per work-for-hire agreement) by Ifbyphone,


Please contact me off-list if you would like to discuss using the utility.
I do not believe there is an issue with us releasing the utility "free as in
beer", however I am not the one that can authorize such a release.  I will
have to confirm this with our upper management.




Brooks R. Bridges

Telecommunications Manager

Ifbyphone, Inc.

Phone: (847) 983-3000

Fax: (847) 676-6553

bbridges at ifbyphone.com



From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org]
On Behalf Of Darren Schreiber
Sent: Wednesday, June 23, 2010 11:58 AM
To: Nicholas Sten; Kristian Kielhofner
Cc: voiceops at voiceops.org
Subject: Re: [VoiceOps] Splitting SIP+RTP PCAP files


What's wrong with pcapsipdump? You can pipe input into that I believe... its
an old tool but it still works. :-)
Nicholas Sten <nicksten at gmail.com> wrote:


Alex has an elegant and inexpensive (read: basically free!) solution that
you might want to check out.  Here's a brief description (I've culled from a
personal email, so I hope I don't misrepresent it)

So I wrote a highly parallelised, multithreaded tool that runs on such a
"capture box" and listens to SIP traffic intelligently.  It automatically
identifies the media ports involved in a call and records both SIP and RTP
to distinct capture files in a dated directory hierarchy separated by day
and hour.  The capture file contains the date, time, ANI, DNIS and Call-ID.

You should give him a shout: Alex Balashov <abalashov at evaristesys.com>

I can vouch for the quality and effectiveness of his solutions.


On Wed, Jun 23, 2010 at 9:02 AM, Kristian Kielhofner
<kristian.kielhofner at gmail.com> wrote:

Hello everyone,

 Does anyone know of a tool to split PCAP files that is SIP+RTP
aware?  Ideally I'd be able to record a PCAP file with any number of
calls and then have a utility split that file into each separate call?
 I'm pretty sure I've seen a utility to do this, I just can't remember
the name...


Kristian Kielhofner
VoiceOps mailing list
VoiceOps at voiceops.org


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20100623/8243b059/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5108 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20100623/8243b059/attachment-0001.bin>

More information about the VoiceOps mailing list