 | 1 | initial version |
So you have shown that Wireshark is capable of dissecting SIP and RTP packets to identify DTMF digits being transmitted. You should study how this is achieved (e.g. from RFC 4733) and study the captures you have to see how it's done in that particular case.
Whether Wireshark can show this or not depends on a multitude of causes, e.g. the encodings used, the preferences set, the protocol elements present in the capture file and the capabilities Wireshark has to correlate all these combinations. I'm not saying there can't be a bug, but it's usually capable of working out the most common cases. It's your job to find out whats going on in detail, hopefully with the packet dissections that Wireshark gives you and the protocol specification in hand.
