If you have a VoIP phone service, like Vonage, you can use tcpdump to capture entire phone conversations that can later be reassembled using only ethereal, rtptools, and Quicktime.

You should be able to do this on a PC using the Windows version of Quicktime player and cygwin or native ports of ethereal and rtptools.

The following steps are for a Mac:

Step 1: Record the phone conversation

Before you start your phone conversation, start the following on your network firewall, or any node that can capture both sent and received traffic from your VoIP device:

# tcpdump -i eth0 -s 1500 -n -w voip.pcap

This will create a file called "voip.pcap" containing all packets sent and received. Leave this running until your call is finished, then cntl-c out of it.

Sure, you can make this much more complicated, or even use other capture tools that output pcap packet capture dumps (like ethereal), but this demonstration is trying to stay as simple as possible for typical firewalls and hosts.

Step 2: Install some required software

To parse through the voip.pcap file and save each half of the conversation (both RTP streams), we will use ethereal.

Before attempting the ethereal install, you will want to install the Apple OS/X Xcode dev environment and the Apple X11.app and Apple X11 SDK. Ethereal is not a carbon app.

To install ethereal quickly and easily, I recommend installing Darwin Ports and use a simple:

# port install ethereal

If you use Fink, you should be able to install it this way:

# apt-get install ethereal
or
# fink install ethereal

The other piece you will need is rtptools. Building it should be as simple as:

# cd /usr/local/src
# curl -o rtptools.tar.gz http://www.cs.columbia.edu/IRT/software/rtptools/download/rtptools-1.18.tar.gz
# tar xvzf rtptools-1.18.tar.gz
# cd rtptools-1.18
# ./configure
# make install

You will also want to download and install something like Ambrosia Software's WireTap Pro to record your audio while you're playing it back.

Step 3: Prepare rtpdump files with ethereal

We're really only using ethereal to filter the tcpdump into component packet capture dumps for each stream.

So, fire up ethereal:

$ export DISPLAY=:0.0
$ ethereal

When ethereal appears, open the "voip.pcap" file. This will open up an Analyze panel with the packet dump.

From the menu bar, select "Statistics". From that Statistics dropdown menu, select "RTP". From the RTP submenu, select "Show all Streams".

A stream selection dialog will appear. There will be a source IP and port and a destination IP and port.

Select the first stream. Look at the destination port number (say port 13456). Now click "Save as". Give this stream a filename that references the destination port number (like "voip-13456.pcap").

Select the second stream. Look at the destination port number (say port 12345). Now click "Save as". Give this stream a filename that references the destination port number (like "voip-12345.pcap").

You are now done with Ethereal.

Step 4: Create an SDP file for Quicktime, and start it up

Noting the above destination ports for each stream, we want to create an SDP file for Quicktime telling it what ports to start playing:

Open up Textedit (or vi, or just cat the following to a file):

v=0
o=icblenke 2890844526 2890842807 IN IP4 127.0.0.1
s=SDPTest
i=SDP file for G711 audio on port 10128
c=IN IP4 127.0.0.1
t=0
m=audio 12345 RTP/AVP 0 8
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
m=audio 13456 RTP/AVP 0 8
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000

This defines two 64k G.711 audio streams on UDP ports 12345 and 13456 (one for each side of the conversation). You will want to change these port numbers with the destination port numbers for your streams.

Yes, Quicktime will play more than one audio stream at a time. No, the other fields really aren't all that important (my name, those extra numbers, the IP, etc).

Now "Open File" the SDP file within Quicktime. Quicktime will report "Connecting", which means that it is waiting for the streams from the step after next.

Step 4: Start WireTap Pro

Be prepared to start the rtpplay commands in the next step shortly after opening WireTap Pro and clicking the record button. You can always edit the recorded AIFF audio later to strip out any captured silence.

Step 5: Fire up rtpplay on the streams

You will need to open up two Terminal windows for this next step, or otherwise stack these so they start at the same time:

$ rtpplay -T -f voip-12345.rtp 127.0.0.1/12345
and
$ rtpplay -T -f voip-13456.rtp 127.0.0.1/13456

Your Quicktime will begin immediately playing the streams. You should hear both sides of the conversation.

Step 6: Stop WireTap Pro and transcode with iTunes

Once the rtpplay streams finish playing, you merely need to stop recording with WireTap Pro. WireTap Pro will prompt you for a filename. The file will be saved in an AIFC (AIFF compressed) format.

After saving, open the AIFC file by double-clicking on it.

Alternatively, Open "Applications > iTunes" (in the Finder, open the folder where you saved your aiff file and move your windows around so you can see the folder and iTunes). Drag your aiff file into iTunes.

Find the AIFC file. Depending on the size of your iTunes repository, you might just want to use the Search function and type in the filename.

With the AIFC file selected, select "Advanced > Convert Selection to AAC" (or MP3 if you have that in your iTunes->Preferences->Advanced->Import settings). iTunes will show a temporary playlist that reads "Converting Songs..." while it encodes the audio.

You now have an AAC or MP3 audio clip of your VoIP conversation.

Enjoy.

This was originally posted by Martin Regner on the ethereal-users mailing list. The above is merely my experience with this quick and dirty technique.