This issue only happens over the customer’s internal network. However, if you know the UDP port used (see above), you can filter on that one.Example: CCX500 will drop calls after an hour into the meeting. You cannot directly filter Skype while capturing. The Skype dissector has a number of fields such as skype.som_type (for the message type). The SampleCaptures page has at least one Skype capture file:

These heuristics are disabled by default to enable them use the Enabled Protocols interface to enable skype_udp. The Skype dissector also has a heuristic dissector (which causes it to examine UDP packets to guess whether they are Skype). Use the Decode-As interface to select traffic to decode as Skype.

The Skype dissector has no preferences at this time. To use this dissector you must use the Decode-As interface to tell Wireshark to try to decode packets as Skype. Wireshark has a basic dissector for the old Skype protocol.

Skype typically uses a wide range of ports in order to circumvent firewalls.īelow is Wireshark's decoding of one frame from a capture on the SampleCaptures page.įrame 215: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)Įthernet II, Src: (00:16:e3:19:27:15), Dst: 192.168.1.2 (00:04:76:96:7b:da) Typically, Skype uses UDP as its transport protocol. Starting in August of 2014 Skype uses Microsoft Notification Protocol 24 Until August of 2014 the Skype protocol was used. Note that both papers may be outdated and that the protocol may have changed since then (the 2006 paper definitely describes things differently from the github description). There's also Silver Needle in the Skype from 2006 (for the networking part look at pages 40ff). However, an effort to do so is underway and appears to be making some progress.Īnother interesting link is a 2004 analysis of Skype's protocol. So far Wireshark is not able to decode Skype traffic because no one has been able to reverse-engineer the protocol. Skype (a popular VoIP and IM application) uses a proprietary (and encrypted) protocol.

How to wireshark ip in skype