Capturing DTMF Using Wireshark

This article explains how to capture DTMF using a Wireshark PCAP.

• Access to Wireshark

1. 1

   Open the Wireshark PCAP.

2. 2

   Filter on SIP packets.

3. 3

   Select Telephony > VoIP Calls from the Menu Bar.

4. 4

   Select your call and click Flow Sequence at the bottom of the screen.

5. 5

   This graphic will display the DTMF as RTP events.

• Filter for rtpevent.

  • This method is not as clean as the previous method, but provides more detailed information.
  • The DTMF key is not ended until you see the (end) event. (see the RED and GREEN highlights in the image above)
  • Clicking on a single line will provide additional information at the bottom of the Wireshark app.