WIRESHARK SECURING VOIP PROFILE
Securing VoIP at Every Layer — Cheesman Press
==============================================

This profile is the security-analysis companion to the diagnostic
"VoIP Analysis" profile that ships with Volume I of The VoIP
Engineer's Library. Install both side-by-side and switch between
them based on the task: VoIP Analysis for call-quality diagnosis,
Securing VoIP for attack/defense analysis.

WHAT'S INCLUDED
---------------
preferences             - Column layout (adds a TLS Version column),
                          dissector settings (RTP heuristic, TLS/DTLS
                          reassembly, SNMP OID display), and a TLS
                          keylog hook for decrypting your own SIPS/TLS
                          traffic.
colorfilters            - Color rules that surface security-relevant
                          patterns at a glance: red for scanner /
                          attack tool fingerprints, orange for L2/L3
                          attack patterns, magenta for key-disclosure
                          events, green for defensive controls
                          working, light blue for TLS/DTLS evidence,
                          yellow for DTMF / PCI-scope events.
dfilters                - 28 pre-loaded filter bookmarks (labeled, in
                          the filter bookmark dropdown next to the
                          filter bar) — one for each common analyst
                          task from the chapter walkthroughs.

INSTALLATION
------------
Wireshark stores profiles in a "profiles" directory. The location
depends on your operating system:

  macOS:    ~/Library/Application Support/Wireshark/profiles/
  Windows:  %APPDATA%\Wireshark\profiles\
  Linux:    ~/.config/wireshark/profiles/

Steps:

  1. Create a new folder named "Securing VoIP" inside the profiles
     directory:

       macOS:    mkdir -p "~/Library/Application Support/Wireshark/profiles/Securing VoIP"
       Linux:    mkdir -p "~/.config/wireshark/profiles/Securing VoIP"
       Windows:  Create folder manually in Explorer

  2. Copy all three files into that folder:
       preferences
       colorfilters
       dfilters

  3. In Wireshark: Edit > Configuration Profiles
     Select "Securing VoIP" and click OK (or double-click it).

  4. Wireshark restarts with the Securing VoIP profile active.
     You will see the custom columns and filter shortcuts
     immediately. The TLS Version column populates whenever a
     TLS handshake record carries a version field.

  5. To switch back to your default profile (or to Vol I's "VoIP
     Analysis" profile if you have it installed):
       Edit > Configuration Profiles > <choose>

WHAT EACH SETTING DOES
----------------------

Column layout. Adds a "TLS Ver" column between Delta and Info.
The column is empty for non-TLS packets — it costs nothing in
non-TLS captures — and populates with the negotiated TLS version
during handshake analysis. Useful when scanning hundreds of TLS
flows for endpoints still negotiating TLS 1.0/1.1.

Name resolution. Disabled. Security analysis frequently involves
attacker IPs that you do NOT want resolved to attacker-controlled
DNS names. Manual lookups (right-click > Resolve Name) remain
available when needed.

SIP / TCP / TLS / DTLS reassembly. All enabled. The Vol II
captures include TLS handshakes with multi-segment Certificate
messages and SIP INVITEs with large SDP bodies (DTLS fingerprints,
multiple a=crypto offers, ICE candidate lists) — reassembly is
required for these to dissect cleanly.

RTP heuristic dissection. Enabled. The Vol II eavesdrop captures
include RTP without prior SDP negotiation in the same capture;
heuristic dissection identifies them as RTP automatically without
the right-click > Decode As step.

SNMP OID display. Enabled. The community-string brute-force
walkthrough analysis depends on seeing every community string and
every OID queried in cleartext.

TLS key log file. Commented out by default. Uncomment and update
the path if you want to decrypt your own production SIPS/TLS
traffic during analysis. (The companion captures in this volume
are illustrative-structure-only with random ciphertext; the
keylog file does nothing useful against them.)

COLOR-RULE PRIORITY
-------------------
Wireshark applies color rules top-to-bottom and uses the first
match. The Securing VoIP profile orders the rules so that
high-priority security events (scanner fingerprints, key
disclosures) override the generic SIP/RTP coloring. If you find
yourself wanting a different priority, edit colorfilters and
re-import via View > Coloring Rules > Import.

REPORTING ISSUES
----------------
If a filter or color rule doesn't behave as documented, file an
issue at the companion site for this volume (seancheesman.com).
Validated against Wireshark 4.6.
