Hello!
When sngrep is running in capture HEP3 traffic mode (-E), it shows all HEP-captured packets. But on saving this to pcap, they cannot be read anymore with sngrep -I or Wireshark with HEP plugin.
I see a packet in Wireshark in a plain text, but it cannot be decoded as a part of a SIP flow.
Cheers,
Ihor