Gargoyle Forum

Hello

I'm trying to create a rule to identify whatsapp calls to place them in a voip class.

So far I identified whatsapp use UDP protocol and port 3478 when calls are placed from my wifi to an external person (my wife's phone on 3G) and whether that's voice or video.

When she calls me (3G to wifi), the connexion is established to a different port (had 54772 and 59209 so far).

Did anybody ever find a reliable way to identify whatsapp calls ? Is it even possible ?

Edit: I tested a call with Skype for business and it uses UDP 3478 too

Did you find a solution?

Nope

sorry if is late but i was thinking the only way i can think of is "Phones IP Address with UDP 3478 into VoIP class" and try setting VoIP/SIP from L7 filters to see if this is any help? again only allow you phones IP

Edit:
https://community.sophos.com/products/u ... 003#286003

So by looking at this, i wouldn't suggest doing ports 5222,5223,5228 as they are used for google play store data but that your choice. Again if you have a PlayStation/PSN then port 3478 is used for voice maybe a good idea to blocked 3478 via a iptables rules so it defaults to port 45395 ?

Phone Internal IP: 192.168.1.102
TCP/UDP: 4244, 5242, 59234, 50318
UDP: 3478,45395

also would add the l7 filter to for SIP/VoIP if any

I can't access your link but anyway I gave up with this.

L7 is broken and does not work on Gargoyle