# Wireshark display filter bookmarks for Securing VoIP analysis
# Securing VoIP at Every Layer — Cheesman Press
#
# These show up as labeled filters in the bookmark dropdown
# (click the bookmark icon next to the filter expression box).
# Format: "Label" filter_expression
# Mirrors the filters used in the chapter "Walking the Capture"
# walkthroughs — one row per common analyst task.
"All SIP" sip
"All RTP" rtp
"VoIP all" sip || rtp || rtcp
"SIPVicious UA" sip.User-Agent contains "friendly-scanner"
"VoIP Hopper" sip.User-Agent contains "voiphopper"
"Identity hdr" sip.Identity
"Bearer auth" sip.Authorization contains "Bearer"
"Digest auth" sip.Authorization contains "Digest"
"INVITE" sip.Method == "INVITE"
"REGISTER" sip.Method == "REGISTER"
"OPTIONS scan" sip.Method == "OPTIONS"
"CANCEL" sip.Method == "CANCEL"
"401 challenge" sip.Status-Code == 401
"SDES crypto" sdp.media_attr contains "crypto"
"ICE candidates" sdp.candidate
"DTMF (PCI)" rtp.p_type == 101
"TLS handshake" tls.handshake
"ClientHello" tls.handshake.type == 1
"TLS Certificate" tls.handshake.type == 11
"DTLS" dtls
"RTCP/SRTCP" rtcp || srtcp
"ARP duplicate" arp.duplicate-address-detected
"VLAN discovery" cdp || lldp
"VLAN tagged" vlan.id != 0
"SNMP v1/v2c" snmp and snmp.version != 3
"TFTP" tftp
"AMI cleartext" tcp.port == 5038
"SIP cleartext" sip and ip.proto == 17
