Exporting/Decoding Call Audio With Wireshark

  • 2
  • 1
  • Question
  • Updated 4 months ago
  • In Progress
I'm trying to use Wireshark to diagnose VoIP quality. I can see the SIP calls just fine but cannot get it to play back the call audio. Does anyone know if it's possible to play the audio from a RingCentral call? It appears to be using the Opus codec and I see no indication that the calls are encrypted but maybe I'm overlooking something.
Photo of tscott16

tscott16

  • 424 Points 250 badge 2x thumb

Posted 9 months ago

  • 2
  • 1
Photo of Chris Rosa

Chris Rosa

  • 1,426 Points 1k badge 2x thumb
I’d expect the call to be encrypted. I don’t know for sure tho. I did find this KB article that seems to support that.

https://success.ringcentral.com/artic...
Photo of tscott16

tscott16

  • 424 Points 250 badge 2x thumb
" If you want to enable Secure Voice for your account, contact RingCentral Support." This seems to imply encryption is opt-in, but I'm not sure.
Photo of Lee

Lee, Champion

  • 3,214 Points 3k badge 2x thumb
I have used Wireshark for the same purpose. Once you save the capture and open it, go to telephony on the menu bar and select VOIP calls. You should see the calls from the capture populate there. Then you can select one and Play Streams. You should be able to hear them. I can on mine. 
Photo of tscott16

tscott16

  • 414 Points 250 badge 2x thumb
I can see the VoIP calls listed here, including the to/from users and phone numbers, but when I try to Play Streams it just doesn't do anything at all, as if there is no data. If I go to Telephony > RTP > RTP Streams, click Analyze and then Play Stream it says "rtp stream is empty or codec is unsupported".
Photo of brett janzen

brett janzen

  • 82 Points 75 badge 2x thumb
Does anyone know if there is a way to get the cert to be able to decode the streams?

Photo of tscott16

tscott16

  • 374 Points 250 badge 2x thumb
If the streams are encrypted, I would assume they are encrypted by RingCentral in which case you wouldn't be able to obtain that certificate. I've read of people successfully decoding with Wireshark like @lee, above, but have yet to get it to work, myself.
Photo of tscott16

tscott16

  • 424 Points 250 badge 2x thumb
Actually, I just now found some relevant info and was able to decode audio in Wireshark. According to RingCentral if HD Voice is enabled on the phone it will encode audio with the OPUS codec. If HD Voice is turned off, it will encode with G.722 codec. G.722 can be natively decoded in Wireshark! Check your RingCentral account settings online and go to Phones & Numbers > Phones > Edit (next to the phone in question) and uncheck "Use HD Voice if possible".
Photo of brett janzen

brett janzen

  • 82 Points 75 badge 2x thumb
I just verified this, the check box for HD calling is NOT checked. I was unable to view the call in wireshark. Do I need to disable encryption or something for this to work?

thanks,
Brett
Photo of tscott16

tscott16

  • 424 Points 250 badge 2x thumb
In Wireshark, try Telephony > RTP > RTP Streams. Click on one of the found streams and click Analyze. Once the analysis is complete, click Play Streams.

Note that a single phone call will have two streams; one incoming and one outgoing. You will need to highlight both streams before clicking Analyze if you want to play back both sides of the conversation. The only way I know to find the pair of streams is to look at the source and destination addresses and find the two that are similar in size (based on packet count).
Photo of brett janzen

brett janzen

  • 82 Points 75 badge 2x thumb
This is the problem, when looking for RTP streams there are none. I found the UDP packets from the phone and did decode as but still wasnt playing correctly, it did see it as g711u.
Photo of tscott16

tscott16

  • 424 Points 250 badge 2x thumb
G711u is what mine shows, as well. Does it give you any sort of error such as "stream is empty" or "codec not supported"? I suppose it's possible you don't have the needed codec installed for playback. You could try K-Lite Codec Pack.