Begin with a specific failed behavior
Record who called whom, the approximate start time, which direction failed and what the user experienced. Distinguish failure to register, failure to set up a call and failure to carry usable media. A packet capture without that context can contain thousands of unrelated transactions and still miss the incident. Identify the signaling and media paths separately. A PBX may anchor media, negotiate direct media or use another relay. Your capture point must see the traffic relevant to the question.
Choose the right instrument
Use capture methodology to select a vantage point. tcpdump provides bounded collection; sngrep makes SIP exchanges easier to follow; Wireshark combines decoded signaling with media analysis. For PBX decisions, collect Asterisk CLI evidence. For sound problems, inspect RTP loss and jitter. Keep DNS and TLS checks tied to the actual configured service identity.
Retain evidence with limits
Capture only authorized traffic, for a defined window, with a file-size limit and protected storage. Packet files can include identities, digest exchanges, DTMF and unencrypted audio. Redact before sharing and keep an unmodified original only where authorized and necessary. Finish an investigation with the first failing boundary, the evidence supporting that conclusion, the change made and the repeated test result. A green status indicator after a reboot is a recovery observation; it is not a complete explanation of the original fault.
Watch the explanation
Explains how the problem determines where to capture, including switch mirroring and paired client/server observations. A useful first step before collecting a VoIP trace.
Read applicability and editorial notes →Watch this video here
Recorded in 2021; capture-placement principles remain useful. Exact operating-system and switch controls vary. Review used the available transcript and primary references; audio and screen readability remain unverified.
The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.