Такой дамп на внешнем интерфейсе офиса.
Код: Выделить всё
tcpdump -i eth4 host sipnet.ru -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth4, link-type EN10MB (Ethernet), capture size 65535 bytes
12:59:04.362538 IP 192.168.253.90.5060 > 212.53.40.40.5060: SIP, length: 613
12:59:04.961373 IP 192.168.253.90.5060 > 212.53.40.40.5060: SIP, length: 381
12:59:05.961362 IP 192.168.253.90.5060 > 212.53.40.40.5060: SIP, length: 381
12:59:06.968483 IP 192.168.253.90.5060 > 212.53.40.40.5060: SIP, length: 381
12:59:08.968315 IP 192.168.253.90.5060 > 212.53.40.40.5060: SIP, length: 381
12:59:12.968352 IP 192.168.253.90.5060 > 212.53.40.40.5060: SIP, length: 381
Код: Выделить всё
tcpdump -i eth3 host sipnet.ru -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth3, link-type EN10MB (Ethernet), capture size 65535 bytes
13:01:01.050505 IP 87.244.33.234.5060 > 212.53.40.40.5060: SIP, length: 381
13:01:01.060555 IP 212.53.40.40.5060 > 87.244.33.234.5060: SIP, length: 441
13:01:01.063829 IP 87.244.33.234.5060 > 212.53.40.40.5060: SIP, length: 613
13:01:01.077055 IP 212.53.40.40.5060 > 87.244.33.234.5060: SIP, length: 611