How does one capture H.323 voice traffic on a VOIP network?

Question

What I am trying to do is capture the WAV data of a phone conversation on a VOIP network using SharpPCap/PCap.Net.

We are using the H.323 recommendation and my understanding is that voice data is located in the RTP packets. However, there is no way to heuristically determine if a UDP packet is a RTP packet, so we have to do more work before we can capture the data.

The H.323 recommendation apparently uses a lot of traffic on specific TCP ports to negotiate the call before the WAV data is sent via RTP. However, I am having very little luck determining what data is actually sent on those TCP ports, when it is sent, what the packets look like, how to handle it, etc.

If anyone has any information on how to go about this I'd really appreciate it. My Google-Fu seems to be failing me on this one.

Answer 1

Wireshark is your friend... I imagine it still has a plugin that will allow you to select a VoIP stream and then save to file. The fun part will be if you are using a switched network.

Wireshark + VoIP

Answer 2

you have to parse h.323 OLC message from both sides then you will be able to know what pakets to capture