Identify the correct stream and direction
Use the negotiated SDP and Wireshark's RTP Streams view to find the relevant addresses, ports and SSRC. Analyze each direction independently. A PBX with two call legs can expose several streams with different codecs and timing. If signaling is missing, heuristic decoding or Decode As may identify RTP, but verify the result against the expected endpoint and payload mapping. Do not classify arbitrary UDP as voice simply because its port falls inside a common media range.
Read statistics in context
Sequence gaps can indicate missing packets, while arrival variation contributes to jitter measurements. Inspect capture drops, reordering and duplicated mirror traffic before assigning every anomaly to the network. RTP timestamps represent a media clock; they are not ordinary wall-clock timestamps. Averages can hide short bursts that disrupt speech. Locate the time of the user's complaint and compare the relevant interval with the whole call. Wireshark playback can help on authorized, decodable media, but its jitter-buffer settings do not necessarily reproduce the phone's actual playout behavior.
Corroborate at another boundary
Compare sender-side and receiver-side evidence, RTCP reports where available and endpoint counters. If a packet exists before a firewall but not after it, check that both capture points actually cover the same forwarding path. Encrypted SRTP is not automatically playable from a packet file. Do not weaken production encryption merely to make an analysis tool's audio button work. Prefer transport counters and controlled test endpoints, and collect sensitive audio only when needed and authorized.
Watch the explanation
Explains why an audio packet can arrive yet be discarded before playback. This distinction helps separate network loss from jitter-buffer and timing problems.
Read applicability and editorial notes →Watch this video here
Conceptual browser-media discussion from 2024. Specific receiver algorithms and statistics vary. Review used the available transcript and primary references; audio and screen readability remain unverified.
The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.
Compares an intact RTP capture with a copy containing deliberately removed packets. The stream list and detailed analysis show how gaps become loss indicators and how burst patterns differ from scattered loss.
Read applicability and editorial notes →Watch this video here
A 2024 Wireshark demonstration; menu placement can change. The second capture is a teaching fixture with simulated loss. Review used the available transcript and primary references; audio and screen readability remain unverified.
The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.