Wireshark is one of the most popular network traffic analyzers that helps us
capture network packets. In this demo, we are going to show you how to capture
voice traffic using Wireshark traffic analyzer.
We will be using Cisco Jabber,
which is on the left, and CSS IP Communicator, on the right, as
two endpoints to make a voice call. Our endpoints will be using
extension number 1001 and 2001.
Both of these are registered with Cisco Unified Communication Manager
as the call agent server. This is the Cisco Sandbox lab where we have
Cisco Unified Communication Manager service, and I'm connected to this
Cisco Sandbox lab over VPN. So let's start by opening Wireshark to
capture the voice traffic.
To do this, we will need to select the network interface that we
want to capture the traffic from. In this case,
its our interface, Ethernet 2. I will double‑click on it and it will start to
capture every traffic that passes through it bidirectional.
Now let me go ahead and start a call from Cisco Jabber to my Cisco IP
communicator from extension 1001 to extension 2001. The call is not
connected yet, and we see lots of signaling packets captured in
Wireshark. Let me bring the call statistics from Cisco Jabber using the
key, Ctrl+Shift+S, which tells me about the call quality of this live
call. The protocol used here by this call is G.722. Then we have the
packet loss, Jitter,
and latency‑related important information. Over here, all looks good.
Now let's stop capturing the network packets, and then let's filter out our
Wireshark packets to show only SIP‑related information.
To do this, we will use the filter here, SIP,
to capture only the Session Initiation Protocol (SIP) traffic. This is the
protocol that is used for call signaling in this call. And now the Wireshark
shows only SIP‑related packets bidirectional.
Let's go ahead and click on Telephony and go to the VoIP Calls to capture
the exact call flow. Since we have both the endpoints, that is Jabber and
Cisco IP Communicator, on this same computer, we see two calls here. Let's
select the first one. Now, Wireshark generated the complete call flow of
this call with my computer on one side and the IP address of the Cisco
Unified Communication Manager Publisher server on the other. In between, we
see all the signalings, like SIP Invite message, 100 Trying, 180 Ringing,
200 OK, with the media codec being negotiated as G.722, and the call goes
on from there for quite some time, that is, around little less than 90
seconds. In any production network, if you encounter any issues related to
the call setup or the call media, that is, the audio,
you can start to capture all the packets using Wireshark tool, and
dig deeper to understand what went wrong during the call. However,
that may not be possible with all the end users agreeing to you to
deploy Wireshark on their computer.
By using Wireshark, we can gain valuable insights into what is
happening in our VoIP network, which can help us troubleshoot issues and optimize network performance.