# Wireshark color rules for Securing VoIP analysis
# Securing VoIP at Every Layer — Cheesman Press
#
# HOW TO IMPORT:
#   Wireshark > View > Coloring Rules > Import
#   Select this file. Rules are applied top to bottom — first match wins.
#
# FORMAT: @rule_name@filter_expression@[fg_r,fg_g,fg_b][bg_r,bg_g,bg_b]
# Colors are in hex RGB format (0-65535 range, Wireshark convention).
#
# ─────────────────────────────────────────────────────────────────
# Color philosophy: red for attack tools, orange for L2/L3 attack
# fingerprints, magenta for key-disclosure events, green for
# defensive controls working as intended, light blue for TLS/DTLS
# evidence, yellow for DTMF / PCI-scope-touching events.
# ─────────────────────────────────────────────────────────────────

# ── Known scanner / attack-tool fingerprints (red) ───────────────
@SIPVicious friendly-scanner User-Agent@sip.User-Agent contains "friendly-scanner"@[65535,65535,65535][52428,0,0]
@SIPVicious svmap/svwar variants@sip.User-Agent contains "sundayddr" or sip.User-Agent contains "sipsak"@[65535,65535,65535][52428,0,0]
@VoIP Hopper tool fingerprint@sip.User-Agent contains "voiphopper"@[65535,65535,65535][52428,0,0]

# ── L2 / L3 attack patterns (orange) ─────────────────────────────
@Gratuitous / duplicate ARP@arp.duplicate-address-detected@[0,0,0][65535,45875,26214]
@802.1Q VLAN tag (any voice VLAN traffic in this capture)@vlan.id != 0@[0,0,0][65535,52428,39321]
@CDP advertisement (potential VLAN leak)@cdp@[0,0,0][65535,52428,39321]
@LLDP advertisement (potential VLAN leak)@lldp@[0,0,0][65535,52428,39321]
@SNMP v1/v2c (cleartext community)@snmp and snmp.version != 3@[0,0,0][65535,45875,26214]
@TFTP (cleartext provisioning)@tftp@[0,0,0][65535,45875,26214]

# ── Key-disclosure events (magenta) ──────────────────────────────
@SDES inline SRTP key in SDP@sdp.media_attr contains "crypto" and sdp.media_attr contains "inline"@[65535,65535,65535][52428,0,52428]
@Cleartext Asterisk AMI (TCP/5038)@tcp.port == 5038@[65535,65535,65535][52428,0,52428]
@SIP Authorization with Digest response@sip and sip.Authorization contains "Digest"@[0,0,0][52428,39321,52428]
@SIP Authorization Bearer (OAuth)@sip.Authorization contains "Bearer"@[0,0,0][52428,39321,52428]

# ── Defensive controls visible (green) ───────────────────────────
@SIP Identity header (STIR/SHAKEN signed)@sip.Identity@[0,0,0][39321,52428,39321]
@TLS handshake successful (Finished)@tls.handshake.type == 20@[0,0,0][39321,52428,39321]
@DTLS handshake (any)@dtls@[0,0,0][39321,52428,39321]

# ── TLS / mTLS evidence (light blue) ─────────────────────────────
@TLS ClientHello@tls.handshake.type == 1@[0,0,0][39321,52428,65535]
@TLS ServerHello@tls.handshake.type == 2@[0,0,0][39321,52428,65535]
@TLS Certificate (mTLS evidence if 2 per session)@tls.handshake.type == 11@[0,0,0][45875,57568,65535]
@TLS Alert (handshake failure)@tls.alert_message@[65535,65535,65535][52428,0,0]

# ── DTMF / PCI-scope events (yellow) ─────────────────────────────
@RFC 4733 telephone-event (DTMF)@rtp.p_type == 101@[0,0,0][65535,52428,0]

# ── Wangiri pattern: CANCEL (analyst inspects time delta) ────────
@SIP CANCEL (potential wangiri)@sip.Method == "CANCEL"@[0,0,0][65535,52428,26214]

# ── Standard SIP coloring (preserved from Vol I, lower priority) ─
@SIP 4xx Error@sip.Status-Code >= 400 && sip.Status-Code < 500@[0,0,0][65535,26214,26214]
@SIP 5xx/6xx Error@sip.Status-Code >= 500@[65535,65535,65535][52428,0,0]
@SIP 200 OK@sip.Status-Code == 200@[0,0,0][39321,52428,39321]
@SIP 180 Ringing@sip.Status-Code == 180@[0,0,0][52428,52428,26214]
@SIP 100 Trying@sip.Status-Code == 100@[0,0,0][52428,52428,52428]
@SIP INVITE@sip.Method == "INVITE"@[0,0,0][39321,52428,65535]
@SIP BYE@sip.Method == "BYE"@[0,0,0][52428,45875,26214]
@SIP REGISTER@sip.Method == "REGISTER"@[0,0,0][45875,39321,65535]
@SIP OPTIONS (scan probe)@sip.Method == "OPTIONS"@[32768,32768,32768][65535,65535,65535]
@SIP Other@sip@[0,0,0][52428,52428,65535]
@RTP No QoS (not EF)@rtp && ip.dsfield.dscp != 46@[0,0,0][65535,45875,45875]
@RTP@rtp@[32768,32768,32768][39321,45875,52428]
@RTCP@rtcp@[32768,32768,32768][45875,52428,52428]
@STUN/ICE@stun@[0,0,0][65535,65535,39321]
