How to capture SIP trunk traces with Wireshark using a Capture Filter
Contents
Contents ................................................................................................................................... 1
Introduction.............................................................................................................................. 2
Network Preparation ............................................................................................................... 3
Wireshark ................................................................................................................................. 4
Data Collection ....................................................................................................................................4
Data Analysis ......................................................................................................................................8
How to capture SIP trunk traces with Wireshark using a Capture Filter
1
Introduction
This document is to provide an engineer with clear instructions on how to;
1/.
Use Wireshark to capture SIP trunk call information (The SIP Ladder)
If you are going to use Wireshark as a Diagnostic Tool there are a couple of options
available when capturing data.
Option 1
Capture everything
This is great if you don’t need to leave the trace running for a while. As you are
capturing everything, if you are on a busy network, it will not take long before your
capture file becomes a monster. As well as taking up valuable disk space you will
then have the problem of finding the few lines that you require, the proverbial ‘Needle
in a haystack’.
Option 2
Learn how to use capture filters
Capture filters restrict the data you are collecting to the correct type or IP address or
similar.
So, in this example we are going to use a capture filter so that all we are going to see
is data from port 5060. This is great if you are diagnosing issues with the SIP call
setup, teardown or similar.
What you will not get is the audio stream, therefore if the issue is the quality of the
call then this report is not for you.
If the issue is occasionally, some calls do something a little strange then this may be
just what you are looking for.
How to capture SIP trunk traces with Wireshark using a Capture Filter
2
Network Preparation
1/.
Configure a monitoring port on a network switch and select the ports to be
monitored.
OR
A hub could be placed between the Mitel 3300 controller and the network port, the
laptop could be plugged into the hub.
How to capture SIP trunk traces with Wireshark using a Capture Filter
3
Wireshark
Data Collection
1/.
Attach the Laptop to monitoring port (or hub).
2/.
Select the interface that Wireshark shout use to capture packets.
This is the first icon below the word file or ‘Interface List’ on the screen
below
If you are given a list of interfaces then generally you want the one with the largest
increasing number below the word packets
How to capture SIP trunk traces with Wireshark using a Capture Filter
4
3/.
Next we want to sort out our capture options
Click on ‘Capture Options’
How to capture SIP trunk traces with Wireshark using a Capture Filter
5
4/.
In the Capture Options form type
Port 5060
Into the field opposite the Capture Filter button
Click ‘Start’
How to capture SIP trunk traces with Wireshark using a Capture Filter
6
5/.
The screen will start to fill with data once SIP calls start to be made.
Once you have sufficient data click on ‘Stop the current live capture’ and save the file
How to capture SIP trunk traces with Wireshark using a Capture Filter
7
Data Analysis
1/.
Go to Telephony -> VoIP Calls
How to capture SIP trunk traces with Wireshark using a Capture Filter
8
2/.
You should then get a window something like this;
Each line represents one SIP call.
Highlight the required call and click on ‘Prepare Filter’
How to capture SIP trunk traces with Wireshark using a Capture Filter
9
3/.
The filter will be inserted into the filter window and then clicking on apply
Will display only the packets from your selected call.
How to capture SIP trunk traces with Wireshark using a Capture Filter
10
4/.
Returning back to step 1 (page 8)
Go to Telephony -> VoIP Calls
How to capture SIP trunk traces with Wireshark using a Capture Filter
11
5/.
You will then go back to the window like this;
However, this time
Highlight the required call and click on ‘Graph’
How to capture SIP trunk traces with Wireshark using a Capture Filter
12
6/.
This time you will be presented with the ‘SIP Ladder’
Here you can see the call setup
Who originated the call
Who they were calling
The codecs which were offered
The phone Ringing
The codecs being used to carry the voice part of the call
The call being hung up
And the hang up being acknowledged.
NOTE
Sometimes there can be a delay between the call being hung up (on the Mitel) and it
being acknowledged by the network. This results in a number of packets being
received by the Mitel after the extension user has cleared down. These will be
reported in the logs as a ‘Zombie Call’
How to capture SIP trunk traces with Wireshark using a Capture Filter
13