How To: TCPDump Sip Voip Capture FreeBSD Tutorial
I recently found out doing a sip capture on a FreeBSD system is a little different than Centos or other linux distributions. Here is a easy to use command that will grab the SIP packets from TCP dump. This will give you an easy to read text file for debugging or tracing.
> tcpdump -i bce1 -n -s0 -vvv udp port 5060 > /usr/src/capture_file
Let’s go over the options for this command:
-i = Interface which on my BSD system was bce1, you can find out what yours is with an ifconfig.
-n = Does not convert ip addresses to host names, leaves them as ip addresses.
-s0 = Capture the whole packet.
-vvv = Verbose, which with 3 v’s gives you all output.
udp port 5060 = This specifies the transport and port you wish to capture.
> /usr/src/capture_file = This grabs all the output and dumps it into a file for reading later.
Exit out of the command with Control + C.