wireshark - packet sniffing

[Piotr Kirklewski]

Hi there

I'm using Wireshark to capture packets in my network. As it's capturing I'm sending some chat messages using Skype.
Then I'm trying to read those strings from Wireshark: File > Find Packet > String

I can't find any of those strings I was sending via Skype.

Does anyone know why ?

Can I somehow set a trap for Skype messages only ?

Regards

Peter

 P.S.This thread has been moved from Insight Remote Support>Security to Security > HP Networking- HP Forums Moderator

[Fred K. Abell Jr._1]

Peter,

Not going to happen with just wireshark.

Remote-exploit.org talks about it being encrypted, and points to a Black Hat paper http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf

Do a google search with 'sniff skype' and you will see it is not a trivial exercise.

Fred

[Fred K. Abell Jr._1]

Okay, here is an update. This answer requires permission and may be considered hacking. It also may violate wiretapping laws. REALLY REALLY REALLY make sure it is legal and you have permission!!!!!!!

But if you are doing research or testing, you could probably use something like Paros. Paros is a security tool for web application vulnerability assessment. This is a man in the middle type of situation. The skype ssl's to the proxy, and the proxy ssl's onto the destination. The proxy sees everything that goes through.

Please do not use this covertly or illegality.

Fred

[krepaa]

hi there,

i am doing research on siptoskype gateway. i have used astrix for that as the skype communicate with sip only i want to see its Start of Message (SOM) or its frame message or ip header message but could not figure out how i can sneak packet of skype from wireshark,,

any help will be acceptable

[bspencer63]

Piotr,

It's all about filters with Wireshark.  You can run the capture with filters or use filters after the capture is complete to see exactly what you want.  Filter by IP or by protocol. 

Check here for Display Filter Reference:  http://www.wireshark.org/docs/dfref/

Check here forHow To Set Up a Capture:  http://wiki.wireshark.org/CaptureSetup

The Wireshark book to use and have for ref is: http://www.chappellu.com/wiresharkbook.html

and of course...Laura Chappels blog: http://laurachappell.blogspot.com/

Other than that, you may sign up for courses at WiresharkU that are very good.  You can even get an all-access pass that is moderately priced that will allow you to see and attend all online courses for one year.

Good luck and hope this helps!