Troubleshooting VOIP calls using wireshark.

Troubleshooting bad quality calls with Wireshark is a great way to narrow down where the source of a problem is. In this post I would like to present the basic means of using wireshark to locate the source of a problem.

In this example we are going to be looking at an issue where we seem to be having problems with outgoing audio and everyone is complaining that our call sound choppy. The incoming audio seems to be just fine. Lets take a look at the route that are call takes. when leaving the network.

The first thing we want to do is to determine if the call is leaving our network without issues, so we need to get a capture as close to the wan as we can. In this example we would want to get a capture between the PBX and the Router since the PBX is directly connected to the router. This capture will show us the state of the inbound audio before it touches the PBX and show us the state of the outbound audio as it is leaving the PBX. It is important to think about the streams this way because knowing what the audio has traversed will allow us to determine where the source of the problem is.

Now, if we listened to this audio from our capture and our outbound audio sounds good then we would know that the problem resides on the WAN side of the network, and we would want to have who ever works on the WAN to check things like T1 errors or QOS policy...

If our issue is heard on the capture then we need to look at the other side.

So we know that the issue is somewhere inside our network, what we need to do at this point is to move the capture around to different places on our network. If we move the capture to the other side, between the PBX and the Switch and re run our capture we can then determine if the problem still exists.

In this capture lets pretend that we still hear the outgoing quality issues, we know that the PBX has not introduced the problem and it is occurring somewhere on our network before getting to the PBX. So lets move the capture again, this time between the Network switch and the phone.

At this point if we are still hearing the problem we know that the switch, the PBX and our WAN are all ok, it seems as if there is a problem between the phone and the switch. Now that we know where the problem resides it will make it a lot easier for us to troubleshoot the problem.