Ask Your Question

'Telephone-event' in RTP Payload

asked 2020-11-12 02:09:35 +0000

Network Direction gravatar image


I've been doing a lot of voice call troubleshooting lately, in particular in the RTP Streams and RTP Stream Analysis areas.

I have found that some calls have 'telephone-event' listed alongside the codec in the payload. (Sorry, I don't have enough points to upload a screenshot of this).

I have also noticed that I can't export the audio stream if the 'telephone-event' is present. When I try, I get the error' Codec is not supported, file is incomplete'. As far as I'm aware my files are not missing anything. If the telephone-event label is not present, I have no difficulties exporting the audio.

I would like to understand what the telephone-event in the payload means. I've tried searching, but I haven't found anything yet. Can anyone help me out?


edit retag flag offensive close merge delete


I think I have worked out part of the issue. Seems pretty obvious now.

The telephone-event is DTMF. That is, 'press 1 for service...' or something like that. When I looked at the flow sequence, I could clearly see 'RTP (telephone-event) DTMF One 1' as part of the flow.

Now to figure out why I can't export the audio...

Network Direction gravatar imageNetwork Direction ( 2020-11-12 02:21:56 +0000 )edit

Ok, Here's the next part. Hopefully it helps someone out.

Any time in-band DTMF is used, I can't export the audio to a file. I've found out how to resolve that. If we want to, we can filter for RTP events like DTMF using rtpevent

So, all we need to do is filter these our before exporting, using !rtpevent When they're filtered out, we can then export the audio to an .au file.

Network Direction gravatar imageNetwork Direction ( 2020-11-12 02:32:08 +0000 )edit

Seems like this could be handled better but will leave to more experienced people to explain.

It can be recreated using SIP_DTMF2.cap from the Wiki Sample Captures

Chuckc gravatar imageChuckc ( 2020-11-12 03:56:30 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-11-13 00:20:37 +0000

Guy Harris gravatar image

updated 2020-11-13 00:20:55 +0000

This is probably best filed as an issue on the Wireshark issues list - at minimum, "Codec is not supported, file is incomplete" is a truly horrible error message, giving no indication what the underlying problem is, much less how to fix it.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-11-12 02:09:35 +0000

Seen: 1,461 times

Last updated: Nov 13 '20