AnsweredAssumed Answered

Voice traffic

Question asked by RSA Admin Employee on Mar 16, 2015
Latest reply on Mar 18, 2015 by RSA Admin

Hi, forum, long time no see :)

I am researching some voice traffic with SA and as you know SA web GUI doesn't play audio, so I'm using NW Investigator (which can connect to remote SA) for that. I wonder if anyone uses SA or NW to monitor voice data because I come across many issues:

1) Investigator detects voice traffic but cannot play it and throws an errors:

Audio codec driver is not defined for RTP payload type #XX

2) Can't find how to manage audio codecs: upload new ones, map codecs to traffic (e.g. parse sip handshake and based on codec signature assign a codec)

3) Can't find how to filter on traffic that contains playable audio

4) Can't find how to download detected audio streams in audio formats not as pcaps

 

Investigator 9.8 is dated 2009. I guess the codecs are very outdated and that's the issue. Also from samples I see that approximately 50% of voice packets are being detected assembled. So I wonder if it is adequate to use NW Investigator for voice research or can anyone recommend anything else?

Are there any plans to integrate voice/chat web gui preview in SA?

Outcomes