Use the Decode-As interface to select traffic to decode as Skype. The Skype dissector has no preferences at this time. To use this dissector you must use the Decode-As interface to tell Wireshark to try to decode packets as Skype. Wireshark has a basic dissector for the old Skype protocol. Example trafficīelow is Wireshark's decoding of one frame from a capture on the SampleCaptures page. Skype typically uses a wide range of ports in order to circumvent firewalls. Typically, Skype uses UDP as its transport protocol.Starting in August of 2014 Skype uses Microsoft Notification Protocol 24 Protocol dependencies Until August of 2014 the Skype protocol was used. Note that both papers may be outdated and that the protocol may have changed since then (the 2006 paper definitely describes things differently from the github description). There's also Silver Needle in the Skype from 2006 (for the networking part look at pages 40ff).

However, an effort to do so is underway and appears to be making some progress.Īnother interesting link is a 2004 analysis of Skype's protocol.

So far Wireshark is not able to decode Skype traffic because no one has been able to reverse-engineer the protocol. Skype (a popular VoIP and IM application) uses a proprietary (and encrypted) protocol.

Wireshark ip puller tutorial skype