Series index · Previous: Suspicious traffic · Next: Incident evidence
The Hardware Ledger · 18 September 2026. Official documentation source-checked. This exercise has not been hardware-tested; expected observations do not establish measured call quality. Menu wording can vary by version.
Question: Did a test call establish correctly, and does its captured media show timing or sequence problems that could explain poor audio?
Outcome: A call worksheet recording signaling, media directions, observed quality indicators, and confidentiality limits.
The legitimate use is troubleshooting a permitted test call. The harmful use is listening to or reconstructing someone else’s conversations. Permission to maintain a network is not automatically permission to listen to calls. Use an explicitly published training trace or your own test call with consent from every participant and authorization covering capture and any playback. Analyze metadata first; a quality investigation often does not require listening.
SIP commonly handles call signaling, while RTP carries media. A visible SIP exchange does not establish that audio arrived. Conversely, encrypted or missing signaling can prevent Wireshark from associating media with a call. Wireshark’s call list is derived from detected signaling and related RTP streams. VoIP Calls
Prepare a suitable trace
Use sip-rtp-g711.pcap under SIP and RTP in Wireshark’s sample collection. Its description identifies a generated SIPp/FreeSWITCH call with hold audio and G.711 codecs. Download through the collection page and record the filename and description. Official sample captures
Alternatively, use an already-recorded, consented test call from your lab. Record whether the capture came from a calling endpoint or a permitted mirror point. A trace that sees only one direction cannot establish what happened on the missing path. Do not change a production call’s encryption to make the exercise easier.
Analyze the call
-
Find signaling and media. Open the working copy with File → Open and apply
sip or rtp or rtcp. Note that an empty result can mean encryption, absent signaling, a different protocol, or failed dissection; it does not prove that there was no call. Clear the filter before opening Telephony → VoIP Calls to avoid accidentally limiting the call list. -
Select one call. In VoIP Calls, select a single entry and choose Flow Sequence. Record the endpoints, start time, and reported state. Use Prepare Filter to isolate its related signaling and media. This is safer than guessing that every packet on a familiar port belongs to the call. Call-list controls
-
Read the signaling. Inspect the initial INVITE, any provisional responses, and the final response. A successful INVITE transaction normally includes a 2xx response and ACK; a BYE later ends the session. Record what the trace actually includes, rather than filling in missing messages. A successful signaling exchange still needs a separate media check. SIP specification, session establishment and termination
-
Identify media directions. In VoIP Calls, select the chosen call and press S to open RTP Streams with its associated streams selected. Opening Telephony → RTP → RTP Streams directly can list streams from other calls, so do not assume the preceding display filter isolates them. Verify source/destination addresses, ports, and SSRC identifiers against the selected call. Select a stream and use Find Reverse to look for its partner. A one-direction sample may be intentional; document its description before calling it one-way-audio failure. Select relevant streams and choose Analyze. Call-list shortcuts, RTP tools
-
Inspect timing and sequence. In RTP Stream Analysis, record packet count, sequence-derived loss, maximum delta, and available jitter figures for each direction. Select an anomalous row and return to its packet. Use the graph to locate bursts of problems rather than relying solely on an average. Some calculations require a recognized codec. RTP analysis fields
-
Verify one stream in the main window. Select its RTP packet, expand Real-Time Transport Protocol, and find the synchronization source. Right-click that field and choose Apply as Filter → Selected. The resulting expression resembles
rtp.ssrc == 0x12345678; use the actual value. Include the relevant addresses/ports if the trace contains reused identifiers. RTP field reference -
Optionally play the published test audio. Only for the approved training/test material, select that call and choose Play Streams, then use the RTP Player’s playback control. Codec support depends on the installed build; check Help → About Wireshark → Plugins, filtered to codecs, if playback fails. Record the playback settings. An analyzer’s reconstruction need not match a phone’s jitter buffer or concealment behavior. Playing VoIP calls
Interpret and protect
Sequence gaps in a capture can reflect lost capture packets as well as lost network packets. Jitter describes variation in arrival timing at this observation point, not a complete user-experience score. Correlate the worksheet with endpoint call statistics and the reported time of the problem. Without that context, report an observed anomaly rather than its assumed cause.
Plain RTP can expose intelligible conversations when the codec is supported. Encrypted SRTP media cannot be assumed playable merely because Wireshark identifies RTP headers. SRTP provides a framework for confidentiality, authentication, and replay protection; metadata can remain observable, and actual protection depends on the negotiated configuration. SIP signaling encryption and media encryption are separate checks. SRTP specification
Use the organization’s supported encrypted signaling and media configuration, limit access to call captures, and retain only the necessary evidence. Treat caller identifiers, dialed digits, call times, and any exported audio as sensitive. Never export an entire call merely to illustrate a timing statistic.
Completion criterion: Identify one call and its visible media direction(s), record two quality indicators with frame references, explain one capture limitation, and state whether content playback was authorized, attempted, and supported.