Capture network packets

The Ethernet Capture Tool records the raw network traffic going in and out of your Dromlik system, so you (or Dromlik support) can see exactly what happened on the wire. It is the fastest way to get to the bottom of extension registration failures, no audio or one-way audio, and intermittent trunk problems.

When to capture packets

• An extension fails to register, or drops registration at random
• Calls connect but there is no audio, or audio only travels one way
• A SIP trunk interconnects intermittently, or calls fail with no obvious error
• Support has asked you for a capture to accompany a ticket

Capture the traffic

1. 1

   Open the capture tool

   Sign in to the Dromlik admin console and go to Maintenance > Troubleshooting > Ethernet Capture Tool.

2. 2

   Start the capture

   Click Start. The system begins recording network packets immediately.

3. 3

   Reproduce the problem

   While the capture is running, reproduce the issue — place the failing call, restart the phone that will not register, or wait for the intermittent trunk failure to occur. Note the exact time so you can find it in the file later.

4. 4

   Stop the capture

   Click Stop. The captured packets are saved to local storage on the system.

5. 5

   Download the file

   Click Download to save the capture to your computer.

Result

The capture downloads as a .tar archive containing a .pcap file. Decompress the archive and open the .pcap file in Wireshark to analyse the SIP signalling and RTP media streams.

Reading the capture in Wireshark

What the capture usually tells you

• No audio one way — RTP is present in one direction only, which almost always points at NAT or a firewall in front of the phone.
• Registration failures — repeated 401/403 responses indicate wrong credentials; no response at all indicates the REGISTER never arrives.
• Choppy audio — gaps in RTP sequence numbers show packet loss on the path.

See also: IP Ping tool, Traceroute tool, System logs.