pcap4j gotPacket(..) returns non ascii chars before SIP message. Why?

Question

I am using PCap4j (a simple Java wrapper for libpcap) to sniff SIP packets on localhost in promiscuous mode. The SIP packets are sent and received by SIPP - a SIP packet test generator.

When receiving a UDP packet in the gotPacket() method, there are a number of strange chars in the start of the received raw packet data. Why is this so? What am I missing here?

I need the buffer to start with SIP INVITE. Is there another protocol wrapping the SIP data? How does one reliably remove the gibberish in the front from the SIP messages. The libpcap filter is set to "udp port sip". Much appreciate

PacketListener listener  = new PacketListener() {
  public void gotPacket(Packet packet) {
    String p = new String(packet.getRawData());
    System.out.println(p);
  }
}


E(0@��(INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK-99365-511233-0
From: sipp <sip:[email protected]:5061>;tag=99365SIPpTag00511233
To: service <sip:[email protected]:5060>
Call-ID: [email protected]
CSeq: 1 INVITE
Contact: sip:[email protected]:5061
Max-Forwards: 70
Subject: Performance Test
Content-Type: application/sdp
Content-Length:   129

v=0
o=user1 53655765 2353687637 IN IP4 127.0.0.1
s=-
c=IN IP4 127.0.0.1
t=0 0
m=audio 6001 RTP/AVP 0
a=rtpmap:0 PCMU/8000

I assume one has to get past ethernet and ip headers, but given that pcap4j is not very well documented, I am not sure how to accomplish this. — jamie

user4585660 user4585660 · Accepted Answer · 2015-02-19T20:31:00

A packet in gotPacket() includes an Ethernet header, an IP header, and a UDP header (if you get it from Ethernet network). To get its UDP payload, do the following: packet.get(UdpPacket.class).getPayload().getRawData()

pcap4j gotPacket(..) returns non ascii chars before SIP message. Why?

1 Answers