This presentation will be about profiling Voice of Internet Protocol (VoIP) traffic in flow. I have been working on a VoIP Training class for our customers and wanted share that knowledge with the greater flow community. Examples given will be heavily obfuscated traffic from various sources but will be based on real data. The following key technical points will be covered: Even though they are many different protocols being deployed you can see in flow that they essentially function in the same way. Comparison of SIP SCCP and Skype protocols how they appear flows with great sensor placement. The parts are broken down into the following: Communication between the user agent (phone) and the user server (server database) Signaling to find the distant end Conversation between end points Comparison between exfiltration voice flow and human conversation voice flow. Data exfiltration using a continues sound codex over a VoIP channel looks like in flow. The exfiltration codex transformed .txt file into a .wav file allowing it to be replayed through VoIP channels. This particular home grown codex provides continuous audio stream. In the flow records you can see the continuous one way stream of data from one end point to another. The human element what voice communication looks like in flow. This will explore the fact that most human conversations are two way. Must like HTTP traffic in where you can see human interactions with the web server within VoIP traffic you can see a conversation happen in a limited capacity depending on the time stamps.