Sniffing and Recording VoIP Traffic
Lately I have been catching up on podcasts that I hadn’t had time to listen to. One of my favorites is SecurityMonkey podcast. It’s by the same guy who writes A Day in the Life of an Information Security Investigator blog. I really wish it would come out more regularly. I always get something out of every single episode.
The last episode I listened to was episode 15. One of the things I got out of this podcast was information about a utility called VoIPong. I’ve copied the description and features from the VoIPong webpage. The next time I have an opportunity to test this program, I will and post my results.
What is VoIPong
VoIPong is a utility which detects all Voice Over IP calls on a pipeline, and for those which are G711 encoded, dumps actual conversation to seperate wave files. It supports SIP, H323, Cisco’s Skinny Client Protocol, RTP and RTCP.
It’s been written in C language for performance reasons, proved to be running on Solaris, Linux and FreeBSD; though it’s thought to compile and run on other platforms as well.
On a 45 Mbit/sec actual network traffic, it’s been verified that VoIPong successfully detected all VoIP gateways and the VoIP calls. CPU utilization during the run has been found ranging between 66% - 80% on a 256MB RAM, Celeron 1700 Mhz Toshiba notebook.
Features
* Produces real .Wav files for direct audio hearing.
* Simple, optimized, extandable fast code
* The algorithm doesn’t depend on signalling but on RTP/RTCP
* Detailed logging. (Comfortable for ‘cut’ and ‘cat’ operations to produce statistics.)
* Powerful management console interface
* Easy installation and administration
* Easy debugging.


