From mboxrd@z Thu Jan  1 00:00:00 1970
From: Nathan Littlepage <nathan@iwantka.com>
Date: Thu, 28 Jul 2005 01:19:52 +0000
Subject: Re: [LARTC] how to classify sip traffic (voip)
Message-Id: <42E832B8.3020401@iwantka.com>
List-Id: <lartc.vger.kernel.org>
References: <3ab2553b050726060238be7524@mail.gmail.com>
In-Reply-To: <3ab2553b050726060238be7524@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
To: lartc@vger.kernel.org

SIP uses 5060. What is hard is to classify is the RTP streams since they=20
use pretty much any port. Its best to classify the SIP and RTP traffic=20
at the endpoints and honor the labeled packets through the network.

Fabian Gervan wrote:
> How i can classify sip traffic (voip)?? =20
>=20
> I try dst 5060 udp port, but dont'work. sip sesion use dynamic port.
>=20
> Sniffing packets with windows net-peeker, I see that packets lenghts
> is always=87
> How i can filter, by  packet lenght, with u32?
>=20
> Regards
> Fabian
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>=20
>=20
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc