PCAP Voice

Turning captured traffic into sound

🎧 Blind test
connecting…

Drop a .pcap / .pcapng here

or click to choose a file — limit 512 MB

Sonification settings

No capture of your own? Try one of these:

Or make your own — guide below ↓

How to make a capture to upload here

Capturing traffic needs administrator rights. Below are tested commands for common situations — copy, run, then drag the resulting file above.

Basics — 60 seconds on an interface

sudo tcpdump -i eth0 -s 0 -w capture.pcap -G 60 -W 1

-s 0 stores whole packets (without it VoIP cannot be decoded), -G 60 -W 1 stops after a minute.

Not sure of the interface name?

ip -br link          # list of interfaces
sudo tcpdump -D      # list as tcpdump sees them

any captures from all of them at once — this app reads such captures (Linux cooked) without trouble.

Size limit — cap at 200 MB

sudo tcpdump -i any -s 0 -w capture.pcap -C 200 -W 1

One host or service only

sudo tcpdump -i eth0 -s 0 -w web.pcap host 10.0.0.5
sudo tcpdump -i eth0 -s 0 -w web.pcap port 80 or port 443
sudo tcpdump -i eth0 -s 0 -w dns.pcap port 53

Without installing anything — via Docker

docker run --rm --net=host --cap-add=NET_ADMIN \
  -v "$PWD:/out" nicolaka/netshoot \
  tcpdump -i eth0 -s 0 -w /out/capture.pcap -G 60 -W 1

Wireshark (recommended)

Install Wireshark, double-click an interface, let it run for a while, then File → Save As and save as .pcapng.

Command line (dumpcap ships with Wireshark)

"C:\Program Files\Wireshark\dumpcap.exe" -i 1 -a duration:60 -w C:\capture.pcapng

List interfaces: dumpcap.exe -D

No install at all — built-in pktmon

pktmon start --capture --pkt-size 0 --file-name C:\capture.etl
pktmon stop
pktmon etl2pcap C:\capture.etl --out C:\capture.pcapng

Run PowerShell as administrator. Works from Windows 10 version 2004.

Built-in tcpdump

sudo tcpdump -i en0 -s 0 -w ~/capture.pcap -G 60 -W 1

List interfaces with ifconfig -l; Wi-Fi is usually en0.

Traffic from an iPhone or iPad

rvictl -s <device-UDID>
sudo tcpdump -i rvi0 -s 0 -w ~/phone.pcap

So the call can actually be heard

We need whole packets and both sides of the call. -s 0 is essential — truncated packets carry only headers and the audio is missing.

sudo tcpdump -i eth0 -s 0 -w call.pcap \
  'port 5060 or (udp and portrange 10000-20000)'

On an Asterisk / FreePBX system

sudo tcpdump -i any -s 0 -w /tmp/call.pcap \
  'host 192.168.1.50 and (port 5060 or udp portrange 10000-20000)'

Replace with the IP of the phone whose call you want to capture.

Which codecs we can play

Yes: G.711 µ-law (PCMU), G.711 A-law (PCMA), G.722, GSM.
No: G.729, G.723, Opus, iLBC, SILK — these need a licensed or missing decoder. The stream is listed in the summary but you will get no audio from it. If you want to hear the call, set the PBX to G.711.

Switch — port mirroring (Cisco SPAN)

monitor session 1 source interface Gi1/0/5 both
monitor session 1 destination interface Gi1/0/24

Plug a machine running tcpdump or Wireshark into port 24.

MikroTik

/tool sniffer set filter-interface=ether1 file-name=capture.pcap
/tool sniffer start
/tool sniffer stop

Download the file through Files in Winbox.

pfSense / OPNsense

Diagnostics → Packet Capture, set detail level to Full, then download as .pcap.

What to watch out for

  • Always -s 0. Without it tcpdump stores only the first 96 bytes and both audio and content are lost.
  • Capture where the traffic actually flows. On a switch you see only your own traffic unless you set up port mirroring.
  • The limit is 512 MB. Split long captures with -C or narrow them with a filter.
  • Captures are sensitive. They contain addresses, names, unencrypted content and call audio — treat them accordingly.
  • Only capture networks you administer or have written permission for.