How to Analyze SIP Calls in Wireshark
Eric Jiang
Thursday at 07:59
Follow
When we face a problem like a call failed or no audio in SIP, usually we need to get the PCAP
dump file and check the packets. This article is about how to use Wireshark to analyze SIP calls.
1. Filter Expression of Wireshark
PCAP dump file contains all the protocols travel the network card, Wireshark has expressions to
filter the packets so that can display the particular messages for the particular protocol. There is
some common string list below:
Filter Description
sip filter SIP Protocol
rtp filter RTP stream
rtcp filter RTCP packets
rtpevent filter DTMF packets
ip.addr use IP address to filter packets, e.g. ip.addr==192.168.5.150 or ip.addr!=192.168.5.150
udp.srcport filter packets depend on the UDP source port, e.g. udp.srcport==10000
filter packets depend on the UDP destination port, e.g. udp.destport==20000 or udp.srcport=
udp.dstport
|| udp.destport==20000
dns filter DNS protocol
wireshark have plenty of filters for sip protocol
most common use is sip.Method and sip.Call-ID.
use sip method to filter sip messages: sip.Method == INVITE
use call-id to filter one particular sip call: sip.Call-ID==20badbbf750c497a80d63ebb8a74a213
We can also filter with some special parameter in the packet through the option 'Prepare a Filter',
select the parameter you want and click right click then you can see the menu display.
See more details about how to use Wireshark, please click Wireshark Wiki.
2. SIP Call analysis
1) List SIP calls
Use the menu entry 'Telephony > VOIP Calls', then you can see the SIP call list.
We can see the information below:
The Start Time and Stop Time of each call.
Initial Speaker is the IP Address of Caller.
Caller ID and Callee ID in the From and To URI.
Select the calls you want to check, then we can see the invalid option Flow Sequence become
available. Click the Flow Sequence button we can see the graph of this call with some details:
SIP signaling flow between different UA.
Direction, source and dest port of RTP stream.
Codec of the RTP stream.
2) Filter one SIP call
In SIP protocol, we can use call-id, from-tag, to-tag to identify a call. Usually, SIP entity will
generate the random call-id string for each call, so we can mark one sip call with the call-id
parameter.
See the following figure about the SIP call filtered by Call-ID.
3) SIP headers
Enable display raw for SIP message so that we don't need to expand every sip header or SDP
parameters.
There are two parts in the sip INVITE request, SIP headers, and SDP.
Just list some import sip headers here:
From: Caller URI
To: destination of the call
Contact: the address for the subsequent request
Also some import parameters in SDP:
media line: m=audio 4000 RTP/AVP 123 8 0 101
media direction: a=sendrecv
codec: a=rtpmap:123 opus/48000/2
ptime: a=ptime:20
3. RTP analysis
When we have a voice issue, we could check the following problem with Wireshak:
Is the RTP stream exist?
Is the RTP stream send and receive on the right IP address and port?
Is the RTP stream be decoded in the right codec?
Is the RTP stream be sent with right ptime?
1) Filter RTP stream
Use 'rtp' as the expression to filter RTP packets.
On the sip call flow graph, we can check RTP direction and codec.
Use the menu 'Telephony > RTP > RTP Streams'.
We can see all the RTP streams display and we can see some information of these RTP
streams, like source port and dest port, SSRC, payload, max delta, lost percentage of the
packets and jitter.
But how could we know which stream is the one we want to check?
On the SIP call flow graph, we can see the source and dest port of one RTP stream
The media line of the SDP message in INVITE or 200OK sip messages
2) Decode UDP packets to RTP
As we know RTP usually uses UDP transport, when the sip call flow in the PCAP file is
incomplete the Wireshark may not parse the UDP packets to RTP streams. we can decode the
UDP packets to RTP manually.
3) Play RTP stream
For now, Wireshark only supports playing pcmu and pcma codec.
Select and Play Stream in the call list
Play one RTP stream, in the RTP Streams list, Analyze > Play Streams
We can see the RTP player after click the Play Streams button.
About how to get PCAP file you can refer to the link: How to Get PCAP Dump Capture
