Start with decoded signaling
Open a bounded capture and apply the sip display filter. If expected messages are absent, check whether the traffic is encrypted, uses an unrecognized port or was never captured. Decode As can help with a known nonstandard port; it cannot decrypt TLS or reconstruct packets missing from the file. Capture filters decide what is collected. Display filters decide what is currently shown. The examples below are display-filter expressions, not tcpdump capture syntax.
Narrow by the call question
Use a Call-ID copied from the affected SIP message, then inspect tags and CSeq when the call forks or renegotiates. The VoIP Calls or SIP Flows window can produce a flow sequence for selected calls. A generated ladder is a reading aid; confirm the original headers when routing or transaction matching is the issue. A Call-ID filter ordinarily selects signaling for that identifier, not all related RTP or every B2BUA leg. Use the call window's related-stream selection and explicit leg correlation when moving to media analysis.
sip
sip.Method == "INVITE"
sip.Status-Code >= 400
sip.Call-ID == "replace-with-observed-call-id"Follow request and response pairs
Read response CSeq methods: 200 OK to CANCEL does not answer the INVITE, and 200 OK to OPTIONS does not establish a call. Find the earliest unexpected response or missing expected packet and identify its source. Preserve the full authorized capture before exporting a narrowed view. Check that the extract retains setup, the failing transition and cleanup. Redact authorization data and personal identifiers before sharing screenshots or packet files.
Watch the explanation
Shows how to distinguish capture filters from display filters, then progressively narrow a conversation without losing sight of the evidence.
Read applicability and editorial notes →Watch this video here
The 2021 interface is older. Use current Wireshark syntax alongside the demonstration. Review used the available transcript and primary references; audio and screen readability remain unverified.
The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.