Yes, Wireshark is a very useful tool. I tend to use tcpdump to do the capture then use Wireshark or sngrep to look at the results. If I just want a quick and easy look at a few packets I use ngrep. sngrep will also capture but it has memory leaks and I find it will often segfault at just a few calls per second.
Here are some examples using tcpdump and ngrep:
Log everything on port 5060 to a file called capture.pcap
Code:
tcpdump -i any -w capture.pcap port 5060
Log everything from ip address 1.2.3.4 on interface eth0 to a file called capture.pcap
Code:
tcpdump -i eth0 -w capture.pcap host 1.2.3.4
Show on screen packets on port 5060
Code:
ngrep -W byline -td any . port 5060
If you are using the Internal and External profiles on their default ports you can log 5080 to see what it happening between Fusion and your supplier and log 5060 to see what is happening between Fusion and your phones. Of course you can log both 5060 and 5080 at the same time.
Code:
tcpdump -i any -w capture.pcap port 5060 or port 5080
When diagnosing problems with audio you need to look at the SDP body part where it exists in the SIP message, typically in an INVITE and the 200 OK - You may see SDP bodies in other messages like a 183 session progress.
Here is a typical INVITE message with an SDP body:
Code:
U 2019/11/18 15:06:10.652575 22.23.24.25:1024 -> 144.145.146.147:5060
INVITE sip:*9664@af-sandpit-1.mydomain.uk:5060 SIP/2.0.
Via: SIP/2.0/UDP 22.23.24.25:1024;branch=z9hG4bK2869618489;rport.
From: "201" <sip:201@af-sandpit-1.mydomain.uk:5060>;tag=2707493168.
To: <sip:*9664@af-sandpit-1.mydomain.uk:5060>.
Call-ID: 0_3506530060@192.168.6.43.
CSeq: 1 INVITE.
Contact: <sip:201@22.23.24.25:1024>.
Content-Type: application/sdp.
Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE.
Max-Forwards: 70.
User-Agent: Yealink SIP-T46S 66.84.0.15.
Supported: 100rel.
Supported: from-change.
Supported: timer.
Session-Expires: 1800;refresher=uac.
Min-SE: 90.
Allow-Events: talk,hold,conference,refer,check-sync.
Supported: replaces.
Content-Length: 255.
.
v=0.
o=- 20154 20154 IN IP4 22.23.24.25.
s=SDP data.
c=IN IP4 22.23.24.25.
t=0 0.
m=audio 12690 RTP/AVP 9 8 101.
a=rtpmap:9 G722/8000.
a=rtpmap:8 PCMA/8000.
a=ptime:20.
a=sendrecv.
a=rtcp:12691.
a=rtpmap:101 telephone-event/8000.
a=fmtp:101 0-15.
This is my desk phone, ext 201, calling music on hold *9664.
The first line shows the source and destination for the packet; my desk phone is on IP 22.23.24.25 and my FusionPBX is on IP 144.145.146.147.
The SDP body is below the dot following the Content-Length header. The c=IN IP4 22.23.24.25. is instructing the PBX to send its audio to IP address 22.23.24.25, and the m=audio 12690 is specifying the port. The SDP in the 200 OK from the PBX will instruct the desk phone where to send it's audio. If all the IP addresses and ports are correct we should have two way speech.
With this information it is relatively easy to see if the audio is being sent to the wrong place.
I hope that helps a little.