Choose the interface and scope
List interfaces and identify the one carrying the affected traffic. Capture only on systems and networks you administer or are authorized to inspect. Select a host or subnet from the actual incident; the documentation address below is a placeholder. A host filter is broader than a SIP-port filter and can include that host's signaling and media, but it still misses direct media between other systems. Confirm the expected topology before running it.
Example collection command
The command below uses full packet snapshots, numeric output and a bounded rotating file set. Replace the interface, authorized host and output directory. The directory must already exist and be writable by the capture process. Stop with Ctrl-C after the controlled test; rotation limits space, not elapsed runtime. -C uses decimal millions of bytes and -W limits the rotating file count with this form. Account for permissions after privilege dropping on your distribution. Keep the output on protected storage with sufficient free space.
sudo tcpdump -i eth0 -nn -s 0 -C 25 -W 4 -w /var/tmp/voip-capture/call.pcap 'host 192.0.2.10'Interpret and finish
Read the capture summary, including dropped-packet counts. Open the resulting file in Wireshark and verify that the intended call's signaling and relevant media are present before changing configuration. A zero-result capture may reflect the wrong interface or filter. Stop the process explicitly, record the time window and remove captures according to the incident retention policy. Avoid leaving a broad capture running indefinitely on a busy PBX. Capture files are sensitive operational records, even when signaling or media was encrypted.
Watch the explanation
Shows how to distinguish capture filters from display filters, then progressively narrow a conversation without losing sight of the evidence.
Read applicability and editorial notes →Watch this video here
The 2021 interface is older. Use current Wireshark syntax alongside the demonstration. Review used the available transcript and primary references; audio and screen readability remain unverified.
The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.
Demonstrates selecting an interface, writing captures to disk and rotating a ring buffer. Helpful when a GUI capture is impractical or an intermittent fault needs a longer observation window.
Read applicability and editorial notes →Watch this video here
The capture concepts still apply; Windows and macOS path examples are from 2021. Review used the available transcript and primary references; audio and screen readability remain unverified.
The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.