There’s a little known feature in Wireshark that allows a PCAP stream to be read from a TCP socket, which is exactly what PCAP-over-IP is! To connect to a PolarProxy PCAP-over-IP service on the local PC, do as follows: I have previously demonstrated how this decrypted stream can be read by NetworkMiner, but it was not until recently that I learned that the same thing can be done with Wireshark as well. If you start PolarProxy with “-pcapoverip 57012” then a PCAP-over-IP listener will be set up on TCP port 57012. PolarProxy comes with a feature called PCAP-over-IP, which provides a real-time PCAP stream with decrypted packets to connecting clients. Users who wish to inspect the decrypted TLS traffic in Wireshark typically open this file from disk, but that doesn’t allow for a real-time view of the traffic. PolarProxy is a TLS proxy that decrypts and re-encrypts TLS traffic, while also saving the decrypted traffic in a PCAP file. This blog post explains how you can configure Wireshark to read decrypted TLS packets directly from PolarProxy over a TCP socket. Note that this would result in wireshark seeing lots of different media streams, which may actually be worse for your purposes.Did you know that it is possible to stream captured packets from a remote device or application to Wireshark in real-time using PCAP-over-IP? I also seem to remember that going in and out of native bridging tended to have this effect. I have remember that something similar may have been added in the official version. We found that whilst this helped with some peers (Cisco) it actually broke things for others.

The place where I used to work added an option that basically caused SSRC to change whenever a source change was signalled, but we were working on an old Asterisk at the time, so weren’t in a position to formally submit it. That is supposed to indicate a good place to reset jitter buffers, not a warning that a different source of timestamps is being used. I don’t know how pjsip handles these and I don’t know if chan_sip has been improved, but Asterisk used not to track the SSRC value, as there was no mechanism in the backbone of Asterisk to carry that information from A to B sides. This typically happens on a source change.

What is wireshark time in