VOIP-RTP-CAPTURECollection

RTP Stream Capture

Sniff or MITM unencrypted RTP audio streams — pcap → Wireshark decodes to .wav; recover voicemail PINs, business intel.

§ Where this technique fits

VOIP-RTP-CAPTURE is catalogued under the Collection tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

MITM unencrypted RTP → call eavesdropping
Most internal SIP deployments still use RTP without SRTP. From the same VLAN, ARP-spoof the IP phone + PBX, capture RTP, decode in Wireshark to .wav.
step 3 / 5

§ What commonly comes next

01
Input Capture
T1056 · Collection
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

MITM unencrypted RTP → call eavesdropping

§ What commonly comes next