be able to share the finding, printing capture in hexadeci- mal form, text format with frame number, etc. They offer protocol decoders, which allow seeing the message details in a verbose format. The key is to find tools with decoders for protocols like H.323, SIP, media gateway con- trol protocol (MGCP), real time protocol (RTP), real time control protocol (RTCP), etc. 8.3.1.1 Wireshark Wireshark [24] is an open source network protocol analyzer for Unix and Win- dows. It allows examining data from a live network or from a capture file on disk. It is possible to interactively browse the capture data, viewing sum- mary and detail information for each packet. Wireshark distribution provides decoders for H.323 (H.225 RAS, H.225.0, H.245), SIP/SDP, MGCP, RTP, RTCP, etc. Figure 8.12 shows the analysis of the unknown content type SIP "torture" test. After the capture session, Wireshark decodes the SIP communication and displays the results in the main program window. The protocol analyzer allows stepping through each captured SIP packet, showing the details of both the packet header fields and the data portion of the packet. 8.3.1.2 LinkBit Online Protocol Analyzer/Decoder LinkBit [25] is an online protocol analyzer and decoder for a wide range of protocols, including H.323, SIP, integrated services digital network (ISDN), © 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security Unknown Content-Type.pcap Wireshark Edit View Go Capture Analyze Statistics Help Eiter: sip&sip. dr--192.168.129.166 Expression.. Clear Apply No. Time Source Destination Protocol 19.298474 192.168.129.19 192.168.129.166 Request: 631 19.684802 192.168.129.166 192.168.129.19 Status: 100 Trying 638 20.429024 192.168.129.166 192.168.129.19 SIP Status: 415 Unsupported Media Type 639 20.432467 192.168.129.19 192.168.129.166 Request: ACK sip:1661110192.168.129.166:5060;transport-udp Frame 627 (620 bytes on wire, 620 bytes captured) Ethernet II, Src: Inte1_5d:d8:75 (00:0e:0c:5d:d8:75). Dst: TelseySp_a0:0c:f8 (00:03:6f:a0