I decided to capture some of those packets (aimed at high numbered UDP ports) and take a closer look at them, so I installed Wireshark and let it run for a while using as filter [src host 84.243.247.100 ] and got nothing! (because my firewall dropped them all off course) so I inserted a temporary firewall rule that would allow all that, otherwise dropped, traffic to pass through.
And I got the following trace while making a call:
Code: Select all
27 2010-09-21 17:50:11.394375 84.243.247.100 192.168.0.5 SIP/SDP Request: INVITE sip:xxxxx@212.187.xxx.xxx, with session description
28 2010-09-21 17:50:11.397864 84.243.247.100 192.168.0.5 SIP Status: 180 Ringing
29 2010-09-21 17:50:16.561758 84.243.247.100 192.168.0.5 SIP Request: ACK sip:212.187.xxx.xxx:5060
30 2010-09-21 17:50:16.564337 84.243.247.100 192.168.0.5 SIP/SDP Status: 200 OK, with session description
31 2010-09-21 17:50:16.564476 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28955, Time=4160626544, Mark
32 2010-09-21 17:50:16.586068 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28956, Time=4160626704
33 2010-09-21 17:50:16.603432 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28957, Time=4160626864
34 2010-09-21 17:50:16.623825 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28958, Time=4160627024
35 2010-09-21 17:50:16.642597 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28959, Time=4160627184
36 2010-09-21 17:50:16.662811 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28960, Time=4160627344
37 2010-09-21 17:50:16.685215 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28961, Time=4160627504
38 2010-09-21 17:50:16.709483 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28962, Time=4160627664
39 2010-09-21 17:50:16.722704 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28963, Time=4160627824
40 2010-09-21 17:50:16.741540 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28964, Time=4160627984
41 2010-09-21 17:50:16.762808 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28965, Time=4160628144
42 2010-09-21 17:50:16.782710 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28966, Time=4160628304
43 2010-09-21 17:50:16.802913 84.243.247.100 192.168.0.5 RTP PT=ITU-T G.729, SSRC=0x71CEB393, Seq=28967, Time=4160628464
44 2010-09-21 17:50:23.095153 84.243.247.100 192.168.0.5 SIP Request: OPTIONS sip:xxxxx@xxxxxxxxxx.org;rinstance=850654
45 2010-09-21 17:50:42.194152 84.243.247.100 192.168.0.5 SIP Request: OPTIONS sip:xxxxx@xxxxxxxxxx.org;rinstance=801865
Any ideas on what this type of traffic is about? Is this a piece of the audio stream just prior to the moment when then the two end RTP sockets are connected?