So, I set up a simple FileZilla FTP server on my Windows machine and attempted to recreate the challenge so I could have documentation on how to perform some of the actions.

The PCAP was taken from a user downloading a file from a misconfigured or outdated FTP server that didn’t have SSL/TLS encryption. You can then press play to listen to the audio in wireshark.This post pertains to a prior Capture-The-Flag (CTF) competition I was competing in where one of the challenges was to read the text (or flag) of a file from a packet capture (PCAP). Right handside window you click “Play streams” The window on the left then pops up. This takes long time on large PCAP files Progress barīelow is what pops up. You wil see the progress bar at the bottom filling up. In the window that pops up choose the new line “current” field and change from “none” to “RTP” Change to RTP Right click on any line in the trace and choose “decode as…” Right click, then choose “Decods as…” Wireshark will then only display UDP packets for that stream In the filter type “UDP.stream = 0” Filter fro UDP.Stream Zero

I decode the UDP streams as RTP and then use the “RTP analyser” to play back and then export the audio as an “AU” file. The way i have been listening to these calls is by using the option in Wireshark to “decode as…”

I am not saying its the best way or the quickest way.

You have narrowed it down to the relevant time period by following this post and you want to listen to the audio.īut if it’s not a SIP call, this is not so easy as choosing “Telephoney/VOIP calls”. It needs updating which i will do hopefully soon. If you dont know how to capture a wireshark trace from an MBG take alook at this post. So you have your self a wireshark trace of a call with audio issues

Extract file pcap wireshark