Asterisk Troubleshooting: Wireshark Intro (Latest Versions)

Capturing Packets Using tcpdump (Server-Side Method)

In production servers, Wireshark GUI is often not installed. Instead, administrators capture traffic using tcpdump and later open the capture file in Wireshark.

Basic SIP Capture

sudo tcpdump -i any -s 0 -w sip_capture.pcap udp port 5060

This records all SIP signaling traffic into a file.

Capture SIP + RTP Together

sudo tcpdump -i any -s 0 -w full_call.pcap udp portrange 10000-20000 or udp port 5060

This captures:

• SIP signaling (port 5060)
• RTP audio packets (default Asterisk range 10000–20000)

Capture Traffic for One Specific IP

sudo tcpdump -i any -s 0 -w call_ip.pcap host 192.168.1.50

Useful when debugging a single phone or provider.

After capture, download the .pcap file and open it in Wireshark for deep analysis.

Opening tcpdump Capture in Wireshark

1. Open Wireshark
2. Click File → Open
3. Select the .pcap file captured via tcpdump
4. Apply SIP or RTP display filters

sip
rtp

Now the full call flow becomes visible.

Using Wireshark Telephony Tools to See Call Legs

Wireshark provides powerful telecom-specific analysis under the Telephony menu.

Step-by-Step to View SIP Call Flow

1. Open the capture file in Wireshark
2. Go to Telephony → VoIP Calls
3. Select a call from the list
4. Click Flow Sequence

This shows a ladder diagram of:

• INVITE
• Ringing
• 200 OK
• ACK
• BYE

It visually confirms which system ended the call and where failures occurred.

Viewing RTP Streams and Playing Audio

1. Go to Telephony → RTP → RTP Streams
2. Select an RTP stream
3. Click Analyze
4. Optionally click Play Streams

This allows you to:

• Confirm audio exists in both directions
• Measure packet loss and jitter
• Listen to the actual captured conversation

If only one RTP stream exists, the issue is almost always NAT or firewall blocking.

Real-World Debugging Workflow (Used by Telecom Engineers)

1. Enable Asterisk SIP logger
2. If unclear → capture using tcpdump
3. Open capture in Wireshark
4. Check VoIP Calls ladder
5. Verify RTP Streams in both directions

Following this order isolates nearly every SIP or audio issue without guesswork.