# Wireshark display filter bookmarks for VoIP analysis
# Network Analysis for VoIP Engineers — Cheesman Press
#
# These show up as labeled filters in the bookmark dropdown
# (click the bookmark icon next to the filter expression box).
# Format: "Label" filter_expression
"All SIP" sip
"All RTP" rtp
"VoIP all" sip || rtp || rtcp
"INVITE" sip.Method == "INVITE"
"REGISTER" sip.Method == "REGISTER"
"BYE" sip.Method == "BYE"
"Transfer flow" sip.Method == "REFER" || sip.Method == "NOTIFY"
"SIP errors" sip.Status-Code >= 400
"200 OK" sip.Status-Code == 200
"DTMF" rtp.p_type == 101
"G.729" rtp.p_type == 18
"RTP no QoS" rtp && ip.dsfield.dscp != 46
"Talk-spurt" rtp.marker == 1
"STUN/DTLS" stun || dtls
"DNS + SIP" dns || sip
"T.38 fax" t38
"TLS errors" tls.alert_message
"Fragments" ip.flags.mf == 1 || ip.frag_offset > 0
"SIP TCP RST" tcp.flags.reset == 1 && tcp.port == 5060
"VLAN discovery" cdp || lldp
