The standard protocol decoders within Wireshark do not correctly decode a lot of the ICE/TURN/RTP/RTCP traffic created by Lync / Skype for Business clients and servers. So I created a LUA plugin for Wireshark that does this job. This plugin can be used on Lync / Skype for Business servers or also on Lync / Skype for Business client machines to allow you to see exactly how ICE/TURN/STUN negotiation and RTP/RTCP traffic is being sent. The plugin has been written based on the specifications in the following documentations:  

Protocol Documentation:           


Release Notes:

1.00 Initial Release:


2.00 Wireshark 2.0 update:



Place the plugin in the following directory and enjoy: "C:\Program Files\Wireshark\plugins\<wireshark version number>\"


More information on the plugin settings and controls can be found here: