Tech

Call PCAP

Published on:

October 14, 2013

Troubleshooting a PBX can be challenging, but the goal is to minimize issues through smart design, like providing NAT traversal solutions for SIP endpoints. When issues arise, it’s essential to have the right tools, such as SIP registration reporting, which notifies administrators of registration issues caused by firewalls or unstable internet connections. Additional tools help with provisioning problems by logging generated files and their history. For call-related issues, the PBX now captures call PCAPs based on trunks or extensions, making it easier to isolate specific problems. TLS and SRTP encryption are also addressed by decoding traffic before sending it to the PCAP subsystem, ensuring accurate timestamps for troubleshooting.

Troubleshooting is an unpleasant necessity when setting up and operating a PBX in the cloud or on customer premises. Our approach is to avoid trouble as much as possible by design, for example, by providing a NAT traversal solution for SIP endpoints. When it comes to trouble, however, it's important to have the necessary tools to find out, quickly, what's going on.

Troubleshooting SIP registrations is relatively simple. By checking out the SIP packets, most cases can be closed quickly. We added registration stability reporting practically from version 1: when an endpoint losses it registration or changes its registration address, the administrator gets an email. This makes it easy to locate buggy firewalls and unstable internet connections. We now have even the overview of how phones are registered in a domain, which very quickly shows where the problems are.

We have also added more and more features for troubleshooting the provisioning process. The PBX writes the generated files into the “generated” folder into the file system; here the administrator can take a look at what the phone has received for provisioning. The latest addition is a history file that shows when each file has been generated.

The most recent addition is the troubleshooting tool for calls. We have seen an increased need to troubleshoot media-related problems with the PBX: this is probably because more and more deployments are happening out there in the “cloud”, where quality of service isn't the same as in the LAN with a PSTN gateway. We have had RTCP-XR reports for many years, and those reports find their way into the MOS graph. They only provide a superficial overview on how users may perceive the overall quality, however, and in real-life PBX operations, the RTCP-XR reports aren'tt enough.

Our old approach to run Wireshark on the system was a good starting point. When you have hosted environments with hundreds of registrations and lots of calls, however, those PCAP files can get huge. What is even worse, though, is that finding the right call is like looking for a needle in a haystack.

In most cases, complaints about call quality affect a certain extension or trunk. Therefore, the PBX records the PCAP for calls based on the trunk or based on an extension. Each calls generates a separate PCAP file; if there are multiple calls that match the capturing criteria, the PBX will write several files accordingly.

Call Pcap

And while we were on it, we also addressed another problem. Recording TLS and SRTP encrypted traffic with Wireshark is difficult by nature. Because the PBX has the security context for both the signaling and the media, it first decodes the traffic before sending it to the PCAP subsystem. Don’t be surprised if you find a SIP packet that was sent over TLS as a UDP packet in the trace - it's just to keep you informed as to what has been sent and received at what time. The RTP time-stamps are critical for the PCAP. In Linux, we are able to retrieve these time-stamps from the networking subsystem for received packets; for sent packets, the PBX takes the current time-stamp and uses it to add the packet to the PCAP file. This must also be done for the other operating systems that don't support retrieving time-stamps from the network subsystem (e.g., Windows). That said, the time-stamps should be good enough to troubleshoot visible and audible problems in the media stream.

Call pcap

The files are put into a directory that depends on the day. Inside the directory, the file name contains the time and the call port number, so it can be easily correlated to the other logs in the system.

The feature is available for all operating systems. This is another distinction from previous releases where PCAP was only available for Linux systems. It is now possible to generate SIP call traces for Windows, MAC, FreeBSD and, of course, the Linux flavors.

The new feature will be available in 5.1.3, with previews available in 5.1.2r.

Latest Articles

View All

The Vodia PBX and SAML Integration

Vodia PBX now supports SAML integration, offering a secure and standards-based method for enterprise users to access their phone system through single sign-on. SAML, or Security Assertion Markup Language, allows employees to authenticate in one system and access other systems without managing multiple passwords, improving both security and user experience. By exchanging digitally signed SAML Assertions between Identity Providers and Service Providers, Vodia ensures seamless authentication across internal and external applications. With this integration, IT teams can simplify user management, reduce login complexity, and maintain strong security controls for business communications.

September 2, 2025

Rethinking Communication in Education: Vodia Smart School

Digital communication is now woven into daily school life, from classroom platforms to how parents and teachers connect. Vodia Smart School takes this further with a VoIP-powered system that provides fast, secure, and documented communication for consent forms, sick notes, and routine notifications. In urgent situations, it enables automated alerts to staff, parents, and first responders, ensuring rapid responses when time is critical. Fully GDPR-compliant and offering features such as caller ID masking, MS Teams integration, and control of bells, announcements, and school systems, Smart School gives schools a modern, reliable alternative to legacy systems while improving both safety and everyday operations.

August 28, 2025

Vodia Now Integrates with Microsoft Teams Presence

Vodia PBX now supports Microsoft Teams Presence, building on its Teams Direct Routing certification and Dynamics 365 integration. Using Graph API from version 69.5.13, a user’s Vodia extension is automatically set to Do Not Disturb when they are on a Teams call. Presence status such as Available, Away, Busy, In a Meeting, or Presenting is matched via the Teams user’s principal username or email, allowing VoIP phones and web portals to show real-time status across devices. This integration connects Teams with a full-featured SIP-compliant PBX, enabling organizations to unify communications, streamline workflows, and support both cloud and on-premise telephony solutions.

August 25, 2025