# No SIP/RTP traffic picked up by Wireshark



## duffman667 (Nov 16, 2012)

Hey everyone. I have been having users at one of my Metro Ethernet sites complain that they have been experiencing dropped calls and something called "Failover" mode on their phones. My company uses a Shoretel phone system. I had already checked every routers interfaces and none of them showed any dropped or error packets so I figured Wireshark was my next step. At the trouble site I mirrored the main switchport that goes from the core switch to the routers internal interface and setup my laptop with Wireshark. I know the mirroring is working correctly because I can see all the other traffic traversing the link (not just mine and broadcasts). But after 3 hours of capturing not one SIP/H.323 or RTP packet went across. I find this hard to believe since this is a call center location with tons of calls in the queue at all times. My LAN adapter is set in promiscuous mode. Does anyone happen to have experience with Shoretel that can explain what exactly I am doing wrong? If you need more info please let me know. Thanks in advance.


----------



## Wand3r3r (Sep 17, 2010)

SIP - The Wireshark Wiki

If you aren't seeing SIP then Shoretel isn't using it. VoIP instead? Then it would only be using IP. Might want to open some of the ip packets to see what they contain.


----------



## duffman667 (Nov 16, 2012)

Ah Wand3r3r yet again you come through :thumb:. I suspected this much but the Shoretel rep swore up and down they it was using SIP. I filtered all traffic based off of the Shoretel's switch IP and found that the RTP packets are being shown as just UDP packets so I had to decode as RTP and they were there. It confirmed my theory that the cheap junk "core" router my boss purchased is the problem. It is being dropped there even though the router says everything is fine. Can't have a router that's only 400mhz and 180kpps at your freaking core... Once again many thanks. I just needed a way to prove it was the problem before he would let me remove the router.


----------



## Wand3r3r (Sep 17, 2010)

Great job in troubleshooting. Best of luck.


----------

