This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

VOIP: Why do DTMF events not show up on Wireshark capture

0

Why do DTMF events (pressing key on phone) not show up in Wireshark capture of a Cisco IP phone. I press various keys during the phone menu after a call connects, but they don't show up. The call and menu choices were successfully completed.

asked 19 Feb '13, 07:41

RAS's gravatar image

RAS
16114
accept rate: 0%


2 Answers:

1

Some questions:

  1. what is your Wireshark version?
  2. do you encrypt the SIP and RTP communication?

Some hints:

If there are DTMF signals in SIP INFO packets, you will find them with this Display filter (uppercase M is intentional!): sip.Method == INFO. See the following capture file: http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=DTMFsipinfo.pcap

If there are DTMF signals in RTP EVENT packets, you will find them with this Display filter: rtpevent. See the following capture file: http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=SIP_DTMF2.cap

If there are DTMF signals inband in the RTP audio stream, then they are just audio signals and your won't see them in Wireshark.

Regards
Kurt

answered 19 Feb '13, 08:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 19 Feb '13, 08:21

Your suggestion above was correct - I found them using sip.Method == INFO . Thank you for the help!

(19 Feb '13, 08:43) RAS

1

It depends on how the Cisco phone or system works it could send the key press evnts as out of band signaling or as tones in the RTP stream or RTP evnts you have to know which method is beeing used.

answered 19 Feb '13, 08:08

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

I have tried "SIP INFO" (out of band) and "Inband" DTMF Transmit types and still nothing shows up in Wireshark. I search the capture for "DTMF" and no results appear.

(19 Feb '13, 08:11) RAS

Well then chanses are that the tone is sent in the voice channel.

(19 Feb '13, 08:17) Anders ♦