Post
Packet captures for VoIP troubleshooting
A packet capture replaces assumptions with evidence. Capture one controlled test call, record the exact time and symptom, and compare signalling and media at the relevant network boundaries.
Minimal capture plan
- Record the caller, callee, time, direction, and symptom.
- Capture at the endpoint, PBX/SBC, or nearest trusted boundary.
- Include SIP, DNS, and the configured RTP range where permitted.
- Follow the Call-ID through registration, INVITE, provisional responses, final response, ACK, and teardown.
- Compare SDP addresses and ports with actual RTP packets.
- Remove or protect recordings and captures because SIP and RTP may contain sensitive data.
What to look for
| Question | Evidence |
|---|---|
| Did the request leave? | Outbound SIP packet and destination |
| Did a response return? | SIP status code, Via path, and timing |
| Was media negotiated? | SDP codec, address, port, and direction |
| Is media bidirectional? | RTP in both directions with advancing sequence numbers |
| Are digits transmitted? | RTP telephone-event packets or SIP INFO |
| Is quality degrading? | Loss, reordering, jitter, and timing patterns |
Privacy and security
SIP captures can contain usernames, phone numbers, authorization material, and call metadata. RTP can contain the conversation. Limit access, redact before sharing, and destroy captures according to the organisation’s retention policy.
Related: SIP response codes, DTMF, and RTP port ranges.