01-01-2009 09:47 AM - last edited on 01-04-2013 06:34 PM by Cathy_xu
I'm using Wireshark to capture packets in my network. As it's capturing I'm sending some chat messages using Skype.
Then I'm trying to read those strings from Wireshark: File > Find Packet > String
I can't find any of those strings I was sending via Skype.
Does anyone know why ?
Can I somehow set a trap for Skype messages only ?
P.S.This thread has been moved from Insight Remote Support>Security to Security > HP Networking- HP Forums Moderator
02-24-2009 02:10 PM
Not going to happen with just wireshark.
Remote-exploit.org talks about it being encrypted, and points to a Black Hat paper http://www.blackhat.com/presentations/bh-europe-06
Do a google search with 'sniff skype' and you will see it is not a trivial exercise.
05-12-2009 12:03 PM
But if you are doing research or testing, you could probably use something like Paros. Paros is a security tool for web application vulnerability assessment. This is a man in the middle type of situation. The skype ssl's to the proxy, and the proxy ssl's onto the destination. The proxy sees everything that goes through.
Please do not use this covertly or illegality.
02-15-2011 04:04 PM
i am doing research on siptoskype gateway. i have used astrix for that as the skype communicate with sip only i want to see its Start of Message (SOM) or its frame message or ip header message but could not figure out how i can sneak packet of skype from wireshark,,
any help will be acceptable
01-04-2013 07:43 AM
It's all about filters with Wireshark. You can run the capture with filters or use filters after the capture is complete to see exactly what you want. Filter by IP or by protocol.
Check here for Display Filter Reference: http://www.wireshark.org/docs/dfref/
Check here forHow To Set Up a Capture: http://wiki.wireshark.org/CaptureSetup
The Wireshark book to use and have for ref is: http://www.chappellu.com/wiresharkbook.html
and of course...Laura Chappels blog: http://laurachappell.blogspot.com/
Other than that, you may sign up for courses at WiresharkU that are very good. You can even get an all-access pass that is moderately priced that will allow you to see and attend all online courses for one year.
Good luck and hope this helps!