From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Alessandro O. Ungaro" <x-arnie@ccpbr.org>
Date: Tue, 26 Jul 2005 13:39:37 +0000
Subject: Re: [LARTC] how to classify sip traffic (voip)
Message-Id: <42E63D19.1000802@ccpbr.org>
List-Id: <lartc.vger.kernel.org>
References: <3ab2553b050726060238be7524@mail.gmail.com>
In-Reply-To: <3ab2553b050726060238be7524@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
To: lartc@vger.kernel.org

Fabian,

on IP/UDP header you have the Length field, you can try to match this.

Regards,

Alessandro Ungaro
x-arnie

Fabian Gervan wrote:
> How i can classify sip traffic (voip)?? =20
>=20
> I try dst 5060 udp port, but dont'work. sip sesion use dynamic port.
>=20
> Sniffing packets with windows net-peeker, I see that packets lenghts
> is always=87
> How i can filter, by  packet lenght, with u32?
>=20
> Regards
> Fabian
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>=20
>=20


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc