I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls.
The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I only see the broadcast traffic from the switch and cannot see the detail of calls I need to pass to our VoIP provider. Our switch is a Netgear FS728TP
I am running Wireshark capture in promiscuous mode but I’m guessing this setup isn’t the correct way to watch VoIP traffic on our LAN. Which of these options would be best to monitor the VoIP traffic?
1. Connect the monitoring laptop and phones to a Hub
This seems the easiest option, but where do you get a hub from these days, plus our handsets are Power Over Ethernet? Can I force our Netgear FS728TP switch to behave like a Hub or do I need to setup Wireshark differently to collect all packets?
2. Use a dual nic machine inline between our PBX and the phones on the switch
I was thinking of using an old Shuttle PC with dual network cards inline to watch all packets and do the trace that way, plus it would be useful in the future if we need to watch network traffic.
3. Buy a dedicated LAN monitoring device
This is obviously the faster method of the home baked Shuttle method but I have no idea what to look for in this area.