Using Wireshark to debug V.34 modem calls over RTP (VoIP)

Once upon a time, it so happend that someone needed to run V.34 over VoIP. And had a problem to get it going. And despite some dire warnings that I could find on the interwebs, that V.anything over VoIP is principally flawed, even with G.711, due to async sampling clocks at either end and whatnot, I ended up just giving it a try.

Given the field setup, where we could not directly hear the troublemaking modems talk to each other (both were far away from the VoIP link and deeply embedded in some black-box hardware), the ability of Wireshark to dissect and decode the RTP voice call traffic turned out to be priceless :-)

Yes we did make it work. Details of the problems encountered are not relevant to snippet of scribble. What's interesting is the analysis done by Wireshark.
Just capture some data (using a mirror port on a switch, or using an intermediate Linux machine acting as a routing or bridging hop) and once you get the traffic captured in wireshark, go to Telephony -> RTP -> RTP Streams. Wireshark identifies two streams per a duplex voice call. If there were several calls in the data capture, Wireshark will find that many times two individual streams. Wireshark will present a list of streams, where you want to select (click) two streams, comprising a duplex call. Or select one stream and use the right mouse button or the "R" key to let Wireshark find a "reverse" = complementary stream in the duplex session. The lookup is based on IP addresses and UDP ports, so it may find several matches if there were several consecutive calls between the same IP's and UDP ports (which possibly map to VoIP gateways and telephone jacks).

Enjoy some examples. The IP addresses have been censored. The audio recordings are courtesy of Audacity with the built-in WASAPI support (under Win7).

Full-size screenshot | MP3 audio
A failing V.34 handshake attempt that never yields a "CONNECT"

Full-size screenshot | MP3 audio
Another V.34 session that almost succeeded but suffers from retrains

Full-size screenshot | MP3 audio
A healthy V.34 session running like a cheetah (DCE rate manually decreased)

By: Frank Rysanek [ rysanek AT fccps DOT cz] in March 2017