# Wireshark preferences for Securing VoIP profile
# Securing VoIP at Every Layer — Cheesman Press
#
# Companion profile for Volume II of The VoIP Engineer's Library.
# Tuned for security analysis: TLS / DTLS / SRTP / SDES / OAuth /
# attack-fingerprint workflows. Builds on Volume I's diagnostic
# column layout and adds four security-relevant custom columns.
#
# Validated against Wireshark 4.6.
#
# See profile installation instructions in README_PROFILE.txt

# ─────────────────────────────────────────────────────────────────
# COLUMN LAYOUT
#
# Standard diagnostic columns (No., Time, Source, Destination,
# Protocol, Length, Delta) plus four security-focused custom
# columns:
#
#   "TLS Ver"      — tls.handshake.version
#                    Populates on TLS handshake records. Lets you
#                    scan a capture for endpoints still negotiating
#                    TLS 1.0/1.1 (0x0301/0x0302) at a glance.
#
#   "TLS Cipher"   — tls.handshake.ciphersuite
#                    Populates on the ServerHello record. Shows the
#                    negotiated cipher in hex (0x1301 = TLS_AES_128_
#                    GCM_SHA256, 0xc030 = ECDHE-RSA-AES256-GCM-
#                    SHA384, etc.). Vol II's TLS walkthroughs lean
#                    on this constantly.
#
#   "Identity"     — sip.Identity
#                    Populates on SIP messages carrying a STIR/
#                    SHAKEN Identity header. Empty for unsigned
#                    SIP and for all non-SIP packets. The column
#                    value will be the full JWT (long); shrink the
#                    column to a narrow width and use "present /
#                    absent" as the visual signal.
#
#   "Auth"         — sip.auth.scheme
#                    Populates with the auth scheme used by a SIP
#                    message — "Digest" or "Bearer" — letting you
#                    distinguish legacy Digest credentials from
#                    modern OAuth bearer tokens in mixed captures.
#
# Wireshark cannot reliably distinguish SRTP from plain RTP at the
# packet level without the negotiated keys. The closest visual
# distinction is in the colorfilters (SRTCP detected via the E-bit
# in the index field; SDP RTP/SAVP profile correlated to its RTP
# stream). For per-packet SRTP indication during your own captures,
# configure the TLS keylog hook at the bottom of this file.
# ─────────────────────────────────────────────────────────────────
gui.column.format: "No.", "%m", "Time", "%Rt", "Source", "%s", "Destination", "%d", "Protocol", "%p", "Length", "%L", "Delta", "%Cus:frame.time_delta_displayed:0:R", "TLS Ver", "%Cus:tls.handshake.version:0:R", "TLS Cipher", "%Cus:tls.handshake.ciphersuite:0:R", "Identity", "%Cus:sip.Identity:0:R", "Auth", "%Cus:sip.auth.scheme:0:R", "Info", "%i"

# ─────────────────────────────────────────────────────────────────
# NAME RESOLUTION — off for performance and clarity.
# Security analysis frequently involves attacker IPs that you do
# NOT want resolved to attacker-controlled DNS names. Manual
# lookups (right-click > Resolve Name) remain available.
# ─────────────────────────────────────────────────────────────────
nameres.mac_name: FALSE
nameres.network_name: FALSE
nameres.transport_name: FALSE
nameres.use_external_name_resolver: FALSE

# ─────────────────────────────────────────────────────────────────
# SIP — reassemble headers and bodies across TCP segments.
# Required for reading INVITEs that carry large SDP (DTLS-SRTP
# fingerprints, multiple a=crypto offers, ICE candidate lists)
# and Identity headers (PASSporT JWTs frequently span segments).
# ─────────────────────────────────────────────────────────────────
sip.desegment_headers: TRUE
sip.desegment_body: TRUE

# ─────────────────────────────────────────────────────────────────
# TCP — reassemble streams and handle out-of-order segments.
# Required for TLS handshake messages that span multiple TCP
# segments (Certificate messages especially can be large).
# ─────────────────────────────────────────────────────────────────
tcp.desegment_tcp_streams: TRUE
tcp.reassemble_out_of_order: TRUE

# ─────────────────────────────────────────────────────────────────
# TLS — verbose dissection.
# Show all extensions in ClientHello/ServerHello so SNI, ALPN,
# supported_versions, key_share, signature_algorithms all decode
# inline rather than requiring sub-tree expansion.
# ─────────────────────────────────────────────────────────────────
tls.desegment_ssl_records: TRUE
tls.desegment_ssl_application_data: TRUE

# ─────────────────────────────────────────────────────────────────
# DTLS — same posture as TLS, plus heuristic dissection so DTLS
# captured on the media port (the Vol II DTLS-SRTP walkthrough)
# is recognized without manual Decode-As steps.
# ─────────────────────────────────────────────────────────────────
dtls.desegment_dtls_records: TRUE

# ─────────────────────────────────────────────────────────────────
# RTP — heuristic dissection so RTP captured without prior SDP
# negotiation (the Vol II eavesdrop captures, the SRTCP-vs-RTCP
# comparison) is recognized without manual Decode-As steps.
# ─────────────────────────────────────────────────────────────────
rtp.heuristic_rtp: TRUE
rtp.rfc2198_payload_type: 99

# ─────────────────────────────────────────────────────────────────
# RTCP — heuristic dissection too. SRTCP-vs-plain-RTCP comparison
# requires the dissector to engage on the RTP+1 port pair.
# ─────────────────────────────────────────────────────────────────
rtcp.heuristic_rtcp: TRUE

# ─────────────────────────────────────────────────────────────────
# CDP / LLDP — relevant for VLAN-discovery captures (VoIP Hopper).
# Enabled by default but commented here for explicit awareness.
# ─────────────────────────────────────────────────────────────────
# cdp.enabled: TRUE      (default)
# lldp.enabled: TRUE     (default)

# ─────────────────────────────────────────────────────────────────
# SNMP — display community strings and OIDs verbosely (the SNMPv2c
# brute-force walkthrough's analysis hinges on seeing every
# community string tried and every OID queried).
# ─────────────────────────────────────────────────────────────────
snmp.display_oid: TRUE
snmp.var_in_tree: TRUE

# ─────────────────────────────────────────────────────────────────
# TFTP — desegment so multi-block transfers (provisioning-config
# fetches) reconstruct cleanly via Follow → UDP Stream.
# ─────────────────────────────────────────────────────────────────
tftp.defragment: TRUE

# ─────────────────────────────────────────────────────────────────
# PACKET LIST
# ─────────────────────────────────────────────────────────────────
gui.packet_list_separator.enabled: TRUE
gui.recent_files_count.max: 20

# ─────────────────────────────────────────────────────────────────
# TLS key log file — uncomment and update path to decrypt SIPS/TLS
# in your own captures and to enable proper SRTP dissection on
# DTLS-SRTP flows. The companion captures in this volume are
# illustrative-structure-only (random ciphertext), so the keylog
# file is not provided and would not help decrypt them.
#
# For your own analysis: set the SSLKEYLOGFILE environment
# variable for the application you're capturing (curl, Chrome,
# OpenSSL-linked tools), point this preference at the same file,
# and Wireshark will decrypt matching flows in real time.
# ─────────────────────────────────────────────────────────────────
# tls.keylog_file: /path/to/sslkeylog.txt
