I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis.
My setup is like this:
On my core switch, all traffic going in and out of gigabit1 is SPAN'd to gigabit2, where I have a linux server connected.
Here's what I've been trying:
I ran tshark looking filtering for my networks and the standard SIP ports. Something like:
tshark -i eth0 -f "(net 1.2.3.4/24 or net 4.5.6.7/24) and (port 5060 or port 5061)" -w ./outfile
Ran this for over a week, then searched through the output file for a list of unique IPs.
I see a few SIP users this way, but not nearly as many as I should. Is there something wrong with this approach? It was my understanding that most major consumer VoIP products, such as Vonage, used SIP for signalling.
What (I think) I want:
I want to actually classify protocols, looking for SIP, RTP etc. If I install L7 Filter I can use iptables to mark the traffic I am interested in, but I don't know where I would go from there to get a list of unique IPs.
I am open to any suggestions.