Troubleshooting Guide - Using Wireshark

Owned by Tom Cavey
Last updated: Jul 14, 2020
3 min read

 Using Wireshark, you can identify and solve a number of issues. Let's go over some common issues we see and how to address them.


Call Failures:
Dropped Call:
For a report of a dropped call you will want to look for the BYE packet. Who sent the BYE is responsible for the call being ended. If you see it coming from VI please let us know. If you see if coming from your equipment you will want to check your logs further to see why the call was ended.



Audio Issues:
Blank Media Packets:
Generally reported as a one-way audio issue you can isolate the RTP packets and check the Payload. You can find this by selecting the RTP packet and expanding Real-Time Transport Protocol. At the bottom is Payload. Normally the payload will appear as random letters and numbers, the bits of data for the call:
Normal Payload:



Blank Media Payload:



You will want to check a capture a few seconds into the call as it is common to see the first few packets being blank. However, if the call has been active for several seconds and you continue to see blank media packets then the party sending the packets is at fault.

One Way Audio:



Looking at the Invite and 200 OK of a call do you see the two media IP's listed and
communicating to each other? If you see only one then the other IP is not sending media. If this is the carrier IP please let support know and provide the capture. If you are not seeing your IP then you will want to check the network and possibly the phone extension.




Internal Media IP:
A common issue which can lead to one way or no audio is an internal media IP being provided by the PBX. You would want to check the packet being sent from your PBX that would provide the media IP. For an inbound call to your DID this would be the 200 OK. If its an outbound call then it would be the Invite. This is generally caused by the NAT settings of the PBX.


Distorted Audio:
If you have reports of audio distortion on a call you want to first start with the RTP packets.

  • Select a RTP Packet

  • On the top bar select Telephony

  • Now RTP

  • Stream Analysis


Depending on which packet you select will change which leg is the Forward and which is the
Reverse. You will want to focus on the following details:

  • Max Delta

  • Max Jitter

  • Max Skew

Traditionally the Delta should be in the 20's. Your Jitter and Skew should also be low. However, if you are seeing these elevated then this could be the culprit to your audio issues. If you are seeing this issue occur from a carrier media IP then please provide the capture to our support team for review. If you are seeing these stats elevated from your device you will want to check your network. Elevated Delat, Jitter and Skew can occur from a number of issues. Is the server the PBX hosted on low on memory or busy with other process? Is the network the PBX located on heavy with data traffic? Is the phone extension involved off site and the ff site ISP having issues? These are a few things to check if you are seeing audio issue coming from your media stream.