1// WSUG Chapter Telephony 2 3[[ChTelephony]] 4 5== Telephony 6 7[[ChTelIntroduction]] 8 9=== Introduction 10 11Wireshark provides a wide range of telephony related network statistics which 12can be accessed via the menu:Telephony[] menu. 13 14These statistics range from specific signaling protocols, to analysis of 15signaling and media flows. If encoded in a compatible encoding the media flow 16can even be played. 17 18The protocol specific statistics windows display detailed information of 19specific protocols and might be described in a later version of this document. 20 21Some of these statistics are described at the 22{wireshark-wiki-url}Statistics pages. 23 24[[ChTelPlayingCalls]] 25 26=== Playing VoIP Calls 27 28The tool for playing VoIP calls is called <<ChTelRtpPlayer,RTP Player>>. It shows RTP streams and its waveforms, allows play stream and export it as audio or payload to file. Its capabilities depends on supported codecs. 29 30==== Supported codecs 31 32RTP Player is able to play any codec supported by an installed plugins. The codecs supported by RTP Player depend on the version of Wireshark you're using. The official builds contain all of the plugins maintained by the Wireshark developers, but custom/distribution builds might not include some of those codecs. To check your Wireshark follow this procedure: 33 34* open menu:Help[About Wireshark] window 35* switch to menu:Plugins[] tab 36* select codec as menu:Filter by type[] 37 38.List of supported codecs 39image::wsug_graphics/ws-about-codecs.png[{screenshot-attrs}] 40 41==== Work with RTP streams - Playlist 42 43Wireshark can be used for RTP stream analysis. User can select one or more streams which can be played later. RTP Player window maintains playlist (list of RTP streams) for this purpose. 44 45Playlist is created empty when RTP Player window is opened and destroyed when window is closed. RTP Player window can be opened on background when not needed and put to front later. During its live, playlist is maintained. 46 47When RTP Player window is opened, playlist can be modified from other tools (Wireshark windows) in three ways: 48 49* button menu:Play Streams[Set playlist] clears existing playlist and adds streams selected in the tool. 50* button menu:Play Streams[Add to playlist] adds streams selected in the tool to playlist. Duplicated streams are not inserted again. 51* button menu:Play Streams[Remove from playlist] removes streams selected in the tool from playlist, if they are in the playlist. 52 53.btn:[Play Streams] button with opened action menu 54image::wsug_graphics/ws-tel-rtp-player_button.png[] 55 56btn:[Play Streams] button can be clicked directly and opens RTP Player window directly with btn:[Set playlist] action. All actions are selectable by small down arrow next to button. 57 58When playlist is empty, there is no difference between btn:[Set playlist] and btn:[Add to playlist]. When RTP Player window is not opened, all three actions above open it. 59 60btn:[Remove from playlist] is useful e. g. in case user selected all RTP streams and wants to remove RTP streams from specific calls found with menu:VoIPCalls[]. 61 62Tools below can be used to maintain content of playlist, they contain btn:[Play Streams] button. You can use one of procedures (Note: btn:[Add to playlist] action is demonstrated): 63 64* Open menu:Telephony[RTP > RTP Streams] window, it will show all streams in the capture. Select one or more streams and then press btn:[Play Streams]. Selected streams are added to playlist. 65* Select any RTP packet in packet list, open menu:Telephony[RTP > Stream Analysis] window. It will show analysis of selected forward stream and its reverse stream (if btn:[Ctrl] is pressed during window opening). Then press btn:[Play Streams]. Forward and reverse stream is added to playlist. 66** menu:RTP Stream Analysis[] window can be opened from other tools too. 67* Open menu:Telephony[VoIP Calls] or menu:Telephony[SIP Flows] window, it will show all calls. Select one or more calls and then press btn:[Play Streams]. It will add all RTP streams related to selected calls to playlist. 68* Open btn:[Flow Sequence] window in menu:Telephony[VoIP Calls] or menu:Telephony[SIP Flows] window, it will show flow sequence of calls. Select any RTP stream and then press btn:[Play Streams]. It will add selected RTP stream to playlist. 69 70.Tools for modifying playlist in RTP Player window 71image::wsug_graphics/ws-tel-playlist.png[] 72 73[NOTE] 74==== 75Same approach with set/add/remove actions is used for RTP Stream Analysis window. The playlist is there handled as different tabs in the window, see <<ChTelRTPAnalysis,RTP Stream Analysis>> window. 76==== 77 78[[ChTelPlayingCallsLive]] 79 80==== Playing audio during live capture 81 82Decoding RTP payload and showing waveforms is time consuming task. To speedup it RTP Player window uses copy of packet payload for all streams in the playlist. During live capture the dialog is not refreshed automatically as other Wireshark dialogs, but user must initiate it. 83 84The copy is created or refreshed and dialog updated: 85 86* Every time window is opened. 87* Every time a new stream is added or set. 88* During live capture, when btn:[Refresh streams] is pressed. 89* Every time live capture is finished/stopped by a user. 90 91When capture file is opened (no live capturing), streams are read complete, no user action is required. Button btn:[Refresh streams] is disabled as it is useless. 92 93When live capture is running, streams are read only till "now" and are shown. When stream is continuous and user would like to see additional part, they must press btn:[Refresh stream]. When the user ends live capture, view is refreshed and button is disabled. 94 95[NOTE] 96==== 97RTP Player dialog stays open even live capture is stopped and then started again. Play list stays unchanged. Therefore btn:[Refresh stream] tries to read same streams as before and shows them if they are still running. Past part of them (from previous live capture) is lost. 98==== 99 100==== RTP Decoding Settings 101 102RTP is carried usually in UDP packets, on random source and destination port. Therefore without "help" Wireshark can't recognize it and shows just UDP packets. Wireshark recognizes RTP streams based on VoIP signaling, e. g. based on SDP message in SIP signaling. When signaling is not captured, Wireshark shows just UDP packets. There are multiple settings which helps Wireshark to recognize RTP even there is no related signaling. 103 104You can use <<ChAdvDecodeAsFig,Decode As...>> function from menu:Analyze[Decode As...] menu or in mouse context menu. Here you can set that traffic on specific source or destination should be decoded as RTP. You can save settings for later use. 105 106Use of menu:Decode As...[] menu works fine, but for many streams it is arduous. 107 108You can enable heuristic dissector menu:rtp_udp[] in menu:Analyze[Enabled Protocols...]. See <<ChCustProtocolDissectionSection>> for details. Once menu:rtp_udp[] is enabled, Wireshark tries every UDP packet to decode as RTP. If decoding is possible, packet (and entire UDP stream) is decoded as RTP. 109 110When RTP stream uses well know port, heuristic dissector ignores it. So you might miss some RTP streams. You can enable setting for udp protocol menu:Preferences[Protocols > udp > Try heuristic sub-dissectors first], see <<ChCustPreferencesSection>>. In this case heuristics dissector tries to decode UDP packet even it uses well known. 111 112[NOTE] 113==== 114Take into account that heuristics is just simple "test" whether packet can be read as RTP. It can be false positive and you can see decoded as RTP more UDP packets than expected. 115 116When you enable menu:udp[Try heuristic sub-dissectors first], it increases possibility of false positives. If you capture all traffic in network, false positives rate can be quite high. 117==== 118 119RTP Player must store decoded data somewhere to be able to play it. When data are decoded, there are audio samples and dictionary for fast navigation. Both types of data are stored in memory for default, but you can configure Wireshark to store it on disk. There are two settings: 120 121* ui.rtp_player_use_disk1 - When set to FALSE (default), audio samples are kept in memory. When set to TRUE, audio samples are stored on temporary file. 122* ui.rtp_player_use_disk2 - When set to FALSE (default), dictionary is kept in memory. When set to TRUE, dictionary is stored on temporary file. 123 124When any data are configured to be stored on disk, one file is created for each stream. Therefore there might be up to two files for one RTP stream (audio samples and dictionary). If your OS or user has OS enforced limit for count of opened files (most of Unix/Linux systems), you can see fewer streams that was added to playlist. Warnings are printed on console in this case and you will see fewer streams in the playlist than you send to it from other tools. 125 126For common use you can use default settings - store everything in memory. When you will be out of memory, switch ui.rtp_player_use_disk1 to TRUE first - it saves much more memory than ui.rtp_player_use_disk2. 127 128 129==== VoIP Processing Performance and Related Limits 130 131Processing of RTP and decoding RTP voice takes resources. There are raw estimates you can use as guidelines... 132 133RTP Streams window can show as many streams as found in the capture. Its performance is limited just by memory and CPU. 134 135RTP Player can handle 1000+ streams, but take into account that waveforms are very small and difficult to recognize in this case. 136 137RTP Player plays audio by OS sound system and OS is responsible for mixing audio when multiple streams are played. In many cases OS sound system has limited count of mixed streams it can play/mix. RTP Player tries to handle playback failures and show warning. If it happens, just mute some streams and start playback again. 138 139RTP Analysis window can handle 1000+ streams, but it is difficult to use it with so many streams - it is difficult to navigate between them. It is expected that RTP Analysis window will be used for analysis of lower tens of streams. 140 141 142[[ChTelVoipCalls]] 143 144=== VoIP Calls Window 145 146The VoIP Calls window shows a list of all detected VoIP calls in the captured 147traffic. It finds calls by their signaling and shows related RTP streams. The current VoIP supported protocols are: 148 149* H.323 150* IAX2 151* ISUP 152* MGCP/MEGACO 153* SIP 154* SKINNY 155* UNISTIM 156 157See https://gitlab.com/wireshark/wireshark/-/wikis/VOIPProtocolFamily[VOIPProtocolFamily] for an overview of the used VoIP protocols. 158 159VoIP Calls window can be opened as window showing all protocol types (menu:Telephony[VoIP Calls] window) or limited to SIP messages only (menu:Telephony[SIP Flows] window). 160 161.VoIP Calls window 162image::wsug_graphics/ws-tel-voip-calls.png[{screenshot-attrs}] 163 164User can use shortcuts: 165 166* Selection 167** kbd:[Ctrl + A] - Select all streams 168** kbd:[Ctrl + I] - Invert selection 169** kbd:[Ctrl + Shift + A] - Select none 170** Note: Common kbd:[Mouse click], kbd:[Shift + Mouse click] and kbd:[Ctrl + Mouse click] works too 171* On selected call/calls 172** kbd:[S] - Selects stream/streams related to call in RTP Streams window (if not opened, it opens it and put it on background). 173** kbd:[D] - Deselects stream/streams related to call in RTP Streams window (if not opened, it opens it and put it on background). 174 175Available controls are: 176 177* btn:[Limit to display filter] filters calls just to ones matching display filter. When display filter is active before window is opened, checkbox is checked. 178* btn:[Time of Day] switches format of shown time between relative to start of capture or absolute time of received packets. 179* btn:[Flow Sequence] opens <<ChStatFlowGraph,Flow Sequence>> window and shows selected calls in it. 180* btn:[Prepare Filter] generates display filter matching to selected calls (signaling and RTP streams) and apply it. 181* btn:[Play Streams] opens <<ChTelRtpPlayer,RTP Player>> window. Actions btn:[Set], btn:[Add] and btn:[Remove] are available. 182* btn:[Copy] copies information from table to clipboard in CSV or YAML. 183 184[[ChTelANSI]] 185 186=== ANSI 187 188This menu shows groups of statistic data for mobile communication protocols according to ETSI GSM standards. 189 190==== A-I/F BSMAP Statistics Window 191 192The A-Interface Base Station Management Application Part (BSMAP) Statistics window shows the messages list and the number of the captured messages. There is a possibility to filter the messages, copy or save the date into a file. 193 194==== A-I/F DTAP Statistics Window 195 196The A-Interface Direct Transfer Application Part (DTAP) Statistics widow shows the messages list and the number of the captured messages. There is a possibility to filter the messages, copy or save the date into a file. 197 198[[ChTelGSM]] 199 200=== GSM Windows 201 202The Global System for Mobile Communications (GSM) is a standard for mobile networks. This menu shows a group of statistic data for mobile communication protocols according to ETSI GSM standard. 203 204[[ChTelIAX2Analysis]] 205 206=== IAX2 Stream Analysis Window 207 208The “IAX2 Stream Analysis” window shows statistics for the forward and reverse 209streams of a selected IAX2 call along with a graph. 210 211[[ChTelISUPMessages]] 212 213=== ISUP Messages Window 214 215Integrated Service User Part (ISUP) protocol provides voice and non-voice signaling for telephone communications. ISUP Messages menu opens the window which shows the related statistics. The user can filter, copy or save the data into a file. 216 217[[ChTelLTE]] 218 219=== LTE 220 221[[ChTelLTEMACTraffic]] 222 223==== LTE MAC Traffic Statistics Window 224 225Statistics of the captured LTE MAC traffic. This window will summarize the LTE 226MAC traffic found in the capture. 227 228.The “LTE MAC Traffic Statistics” window 229image::wsug_graphics/ws-stats-lte-mac-traffic.png[{screenshot-attrs}] 230 231The top pane shows statistics for common channels. Each row in the middle pane 232shows statistical highlights for exactly one UE/C-RNTI. In the lower pane, you 233can see the for the currently selected UE/C-RNTI the traffic broken down by 234individual channel. 235 236[[ChTelLTERLCGraph]] 237 238==== LTE RLC Graph Window 239 240The LTE RLC Graph menu launches a graph which shows LTE Radio Link Control protocol sequence numbers changing over time along with acknowledgements which are received in the opposite direction. 241 242NOTE: That graph shows data of a single bearer and direction. The user can also launch it from the `RLC Statistics` window. 243 244.The RLC Graph window 245image::wsug_graphics/ws-rlc-graph.png[{screenshot-attrs}] 246 247[.small]#_The image of the RLC Graph is borrowed from link:https://gitlab.com/wireshark/wireshark/-/wikis/RLC-LTE[Wireshark wiki]._# 248 249[[ChTelLTERLCTraffic]] 250 251==== LTE RLC Traffic Statistics Window 252 253Statistics of the captured LTE RLC traffic. This window will summarize the LTE 254RLC traffic found in the capture. 255 256.The “LTE RLC Traffic Statistics” window 257image::wsug_graphics/ws-stats-lte-rlc-traffic.png[{screenshot-attrs}] 258 259At the top, the check-box allows this window to include RLC PDUs found within 260MAC PDUs or not. This will affect both the PDUs counted as well as the display 261filters generated (see below). 262 263The upper list shows summaries of each active UE. Each row in the lower list 264shows statistical highlights for individual channels within the selected UE. 265 266The lower part of the windows allows display filters to be generated and set for 267the selected channel. Note that in the case of Acknowledged Mode channels, if a 268single direction is chosen, the generated filter will show data in that 269direction and control PDUs in the opposite direction. 270 271[[ChTelMTP3]] 272 273=== MTP3 Windows 274 275The Message Transfer Part level 3 (MTP3) protocol is a part of the Signaling System 7 (SS7). The Public Switched Telephone Networks use it for reliable, unduplicated and in-sequence transport of SS7 messaging between communication partners. 276 277This menu shows MTP3 Statistics and MTP3 Summary windows. 278 279[[ChTelOsmux]] 280 281=== Osmux Windows 282 283OSmux is a multiplex protocol which benefits satellite based GSM back-haul systems by reducing the bandwidth consumption of the voice proxying (RTP-AMR) and signaling traffic. The OSmux menu opens the packet counter window with the related statistic data. The user can filter, copy or save the data into a file. 284 285=== RTP 286 287[[ChTelRTPStreams]] 288 289==== RTP Streams Window 290 291The RTP streams window shows all RTP streams in capture file. Streams can be selected there and on selected streams other tools can be initiated. 292 293.The “RTP Streams” window 294image::wsug_graphics/ws-tel-rtp-streams.png[{screenshot-attrs}] 295 296User can use shortcuts: 297 298* Selection 299** kbd:[Ctrl + A] - Select all streams 300** kbd:[Ctrl + I] - Invert selection 301** kbd:[Ctrl + Shift + A] - Select none 302** Note: Common kbd:[Mouse click], kbd:[Shift + Mouse click] and kbd:[Ctrl + Mouse click] works too 303* Find Reverse 304** kbd:[R] - Try search for reverse streams related to already selected streams. If found, selects them in the list too. 305** btn:[Shift+R] - Select all pair streams (forward/reverse relation). 306** btn:[Ctrl+R] - Select all single streams (no reverse stream does exist). 307* kbd:[G] - Go to packet of stream under the mouse cursor. 308* kbd:[M] - Mark all packets of selected streams. 309* kbd:[P] - Prepare filter matching selected streams and apply it. 310* kbd:[E] - Export selected streams in RTPDump format. 311* kbd:[A] - Open <<ChTelRTPAnalysis,RTP Stream Analysis>> window and add selected streams to it. 312 313Available controls are: 314 315* Find Reverse 316** btn:[Find Reverse] search for reverse stream of every selected stream. If found, selects it in the list too. 317** btn:[Find All Pairs] select all streams which have forward/reverse relation. 318** btn:[Find Only Single] select all streams which are single - have no reverse stream. 319* btn:[Analyze] opens <<ChTelRTPAnalysis,RTP Stream Analysis>> window. Actions btn:[Set], btn:[Add] and btn:[Remove] are available. 320* btn:[Prepare Filter] prepares filter matching selected streams and apply it. 321* btn:[Play Streams] opens <<ChTelRtpPlayer,RTP Player>> window. Actions btn:[Set], btn:[Add] and btn:[Remove] are available. 322* btn:[Copy] copies information from table to clipboard in CSV or YAML. 323* btn:[Export] exports selected streams in RTPDump format. 324 325 326[[ChTelRTPAnalysis]] 327 328==== RTP Stream Analysis Window 329 330The RTP analysis function takes the selected RTP streams and generates a list of statistics on it including graph. 331 332Menu menu:Telephony[RTP > RTP Stream Analysis] is enabled only when selected packed is RTP packet. When window is opened, selected RTP stream is added to analysis. If btn:[Ctrl] is pressed during menu opening, reverse RTP stream (if exists) is added to the window too. 333 334Every stream is shown on own tab. Tabs are numbered as streams are added and its tooltip shows identification of the stream. When tab is closed, number is not reused. Color of tab matches color of graphs on graph tab. 335 336.The “RTP Stream Analysis” window 337image::wsug_graphics/ws-tel-rtpstream-analysis_1.png[{screenshot-attrs}] 338 339.Error indicated in “RTP Stream Analysis” window 340image::wsug_graphics/ws-tel-rtpstream-analysis_3.png[{screenshot-attrs}] 341 342Per packet statistic shows: 343 344* Packet number 345* Sequence number 346* Delta (ms) to last packet 347* Jitter (ms) 348* Skew 349* Bandwidth 350* Marker - packet is marked in RTP header 351* Status - information related to the packet. E. g. change of codec, DTMF number, warning about incorrect sequence number. 352 353Side panel left to packet list shows stream statistics: 354 355* Maximal delta and at which packet it occurred 356* Maximal jitter 357* Mean jitter 358* Maximal skew 359* Count of packets 360* Count of lost packets - calculated from sequence numbers 361* When the stream starts and first packet number 362* Duration of the stream 363* Clock drift 364* Frequency drift 365 366[NOTE] 367==== 368Some statistic columns are calculated only when Wireshark is able to decode codec of RTP stream. 369==== 370 371Available shortcuts are: 372 373* kbd:[G] - Go to selected packet of stream in packet list 374* kbd:[N] - Move to next problem packet 375 376Available controls are: 377 378* Prepare Filter 379** btn:[Current Tab] prepares filter matching current tab and applies it. 380** btn:[All Tabs] prepares filter matching all tabs and applies it. 381* btn:[Play Streams] opens <<ChTelRtpPlayer,RTP Player>> window. Actions btn:[Set], btn:[Add] and btn:[Remove] are available. 382* btn:[Export] allows export current stream or all streams as CSV or export graph as image in multiple different formats (PDF, PNG, BMP and JPEG). 383 384.Graph in “RTP Stream Analysis” window 385image::wsug_graphics/ws-tel-rtpstream-analysis_2.png[{screenshot-attrs}] 386 387Graph view shows graph of: 388 389* jitter 390* difference - absolute value of difference between expected and real time of packet arrival 391* delta - time difference from reception of previous packet 392 393for every stream. Checkboxes below graph are enabling or disabling showing of a graph for every stream. btn:[Stream X] checkbox enables or disables all graphs for the stream. 394 395[NOTE] 396==== 397Stream Analysis window contained tool for save audio and payload for analyzed streams. This tool was moved in Wireshark 3.5.0 to <<ChTelRtpPlayer,RTP Player>> window. New tool has more features. 398==== 399 400[[ChTelRtpPlayer]] 401 402==== RTP Player Window 403 404The RTP Player function is tool for playing VoIP calls. It shows RTP streams and its waveforms, allows play stream and export it as audio or payload to file. See related concepts in <<ChTelPlayingCalls>>. 405 406Menu menu:Telephony[RTP > RTP Player] is enabled only when selected packed is RTP packet. When window is opened, selected RTP stream is added to playlist. If btn:[Ctrl] is pressed during menu opening, reverse RTP stream (if exists) is added to the playlist too. 407 408.RTP Player window 409image::wsug_graphics/ws-tel-rtp-player_1.png[{screenshot-attrs}] 410 411RTP Player Window consists of three parts: 412 413. Waveform view 414. Playlist 415. Controls 416 417Waveform view shows visual presentation of RTP stream. Color of waveform and playlist row are matching. Height of wave shows volume. 418 419Waveform shows error marks for Out of Sequence, Jitter Drops, Wrong Timestamps and Inserted Silence marks if it happens in a stream. 420 421.Waveform with error marks 422image::wsug_graphics/ws-tel-rtp-player_3.png[{screenshot-attrs}] 423 424Playlist shows information about every stream: 425 426* Play - Audio routing 427* Source Address, Source Port, Destination Address, Destination Port, SSRC 428* Setup Frame 429** SETUP <number> is shown, when there is known signaling packet. Number is packet number of signaling packet. Note: Word SETUP is shown even RTP stream was initiated e. g. by SKINNY where no SETUP message exists. 430** RTP <number> is shown, when no related signaling was found. Number is packet number of first packet of the stream. 431* Packets - Count of packets in the stream. 432* Time Span - Start - Stop (Duration) of the stream 433* SR - Sample rate of used codec 434* PR - Decoded play rate used for stream playing 435* Payloads - One or more playload types used by the stream 436 437[NOTE] 438==== 439When rtp_udp is active, most of streams shows just RTP <number> even there is setup frame in capture. 440 441When RTP stream contains multiple codecs, SR and PR is based on first observed coded. Later codecs in stream are resampled to first one. 442==== 443 444Controls allow a user to: 445 446* btn:[Start]/btn:[Pause]/btn:[Stop] playing of unmuted streams 447* btn:[>>] enabling/disabling silence skipping 448** Min silence - Minimal duration of silence to skip in seconds. Shorter silence is played as it is. 449* Select btn:[Output audio device] and btn:[Output audio rate] 450* Select btn:[Playback Timing] 451** Jitter Buffer - Packets outside btn:[Jitter Buffer] size are discarded during decoding 452** RTP Timestamp - Packets are ordered and played by its Timestamp, no Jitter Buffer is used 453** Uninterrupted Mode - All gaps (e. g. Comfort Noise, lost packets) are discarded therefore audio is shorted than timespan 454* btn:[Time of Day] selects whether waveform timescale is shown in seconds from start of capture or in absolute time of received packets 455* btn:[Refresh streams] refreshes streams during live capture (see <<ChTelPlayingCallsLive>>). Button is disabled when no live capture is running. 456* Inaudible streams 457** btn:[Select] select all inaudible streams (streams with zero play rate) 458** btn:[Deselect] deselect all inaudible streams (streams with zero play rate) 459* btn:[Analyze] open <<ChTelRTPAnalysis,RTP Stream Analysis>> window. Actions btn:[Set], btn:[Add] and btn:[Remove] are available. 460* btn:[Prepare Filter] prepare filter matching selected streams and apply it. 461* btn:[Export] - See <<tel-rtp-export>>. 462 463[NOTE] 464==== 465RTP Player detects silence just by missing voice samples (Comfort Noise, interrupted RTP, missing RTP, ...) or when some streams are muted. 466==== 467 468.RTP stream state indication 469image::wsug_graphics/ws-tel-rtp-player_2.png[{screenshot-attrs}] 470 471Waveform view and playlist shows state of a RTP stream: 472 473. stream is muted (dashed waveform, menu:Muted[] is shown in Play column) or unmuted (non-dashed waveform, audio routing is shown in Play column) 474. stream is selected (blue waveform, blue row) 475. stream is below mouse cursor (bold waveform, bold font) 476 477User can control to where audio of a stream is routed to: 478 479* L - Left channel 480* L+R - Left and Right (Middle) channel 481* R - Left channel 482* P - Play (when mono soundcard is available only) 483* M - Muted 484 485Audio routing can be changed by double clicking on first column of a row, by shortcut or by menu. 486 487User can use shortcuts: 488 489* Selection 490** kbd:[Ctrl + A] - Select all streams 491** kbd:[Ctrl + I] - Invert selection 492** kbd:[Ctrl + Shift + A] - Select none 493** Note: Common kbd:[Mouse click], kbd:[Shift + Mouse click] and kbd:[Ctrl + Mouse click] works too 494* Go to packet 495** kbd:[G] - Go to packet of stream under the mouse cursor 496** kbd:[Shift + G] - Go to setup packet of stream under the mouse cursor 497* Audio routing 498** kbd:[M] - Mute all selected streams 499** kbd:[Shift + M] - Unmute all selected streams 500** kbd:[Ctrl + M] - Invert muting of all selected streams 501* kbd:[P] - Play audio 502* kbd:[S] - Stop playing 503* kbd:[Del] or kbd:[Ctrl + X] - Remove all selected streams from playlist 504* Inaudible steams 505** kbd:[N] - Select all inaudible streams 506** kbd:[Shift + N] - Deselect all inaudible streams 507 508[[tel-rtp-export]] 509 510===== Export 511 512[NOTE] 513==== 514menu:Export[] was moved from menu:RTP Stream Analysis[] window to menu:RTP Player[] window in 3.5.0. 515 516Wireshark is able to export decoded audio in .au or .wav file format. Prior to version 3.2.0, Wireshark only supported exporting audio using the G.711 codec. From 3.2.0 it supports audio export using any codec with 8000 Hz sampling. From 3.5.0 is supported export of any codec, rate is defined by Output Audio Rate. 517==== 518 519Export options available: 520 521* for one or more selected non-muted streams 522** From cursor - Streams are saved from play start cursor. If some streams are shorter, they are removed from the list before save and count of saved streams is lower than count of selected streams. 523** Stream Synchronized Audio - File starts at the begin of earliest stream in export, therefore there is no silence at beginning of exported file. 524** File Synchronized Audio - Streams starts at beginning of file, therefore silence can be at start of file. 525* for just one selected stream 526** Payload - just payload with no information about coded is stored in the file 527 528Audio is exported as multi-channel file - one channel per RTP stream. One or two channels are equal to mono or stereo, but Wireshark can export e.g. 100 channels. For playing a tool with multi-channel support must be used (e.g. https://www.audacityteam.org/). 529 530Export of payload function is useful for codecs not supported by Wireshark. 531 532[NOTE] 533==== 534Default value of btn:[Output Audio Rate] is btn:[Automatic]. When multiple codecs with different codec rates are captured, Wireshark decodes each stream with its own play audio rate. Therefore each stream can has different play audio rate. When export of audio is used in this case, it will fail because .au or .wav requires one common play audio rate. 535 536In this case user must manually select one of rates in btn:[Output Audio Rate], streams will be resampled and audio export succeeds. 537==== 538 539[[ChTelRTSP]] 540 541=== RTSP Window 542 543In the Real Time Streaming Protocol (RTSP) menu the user can check the Packet Counter window. It shows Total RTCP Packets and divided into RTSP Response Packets, RTSP Request Packets and Other RTSP packets. The user can filter, copy or save the data into a file. 544 545[[ChTelSCTP]] 546 547=== SCTP Windows 548 549Stream Control Transmission Protocol (SCTP) is a computer network protocol which provides a message transfer in telecommunication in the transport layer. It overcomes some lacks of User Datagram Protocol (UDP) and Transmission Control Protocol (TCP). The SCTP packets consist of the _common header_ and the _data chunks_. 550 551The SCTP Analyze Association window shows the statistics of the captured packets between two Endpoints. You can check the different chunk types by pressing btn:[Chunk Statistics] button in the `Statistics` tab. In the `Endpoint` tabs you can see various statistics, such as IP addresses, ports and others. Also you can check different graphs here. 552 553.SCTP Analyze Association window 554image::wsug_graphics/ws-sctp-1-association.png[{screenshot-attrs}] 555 556The SCTP Associations window shows the table with the data for captured packets, such as port and counter. You can also call for the SCTP Analyze Association window by pressing the btn:[Analyze] button. 557 558.SCTP Associations window 559image::wsug_graphics/ws-sctp.png[{screenshot-attrs}] 560 561[[ChTelSMPPOperations]] 562 563=== SMPP Operations Window 564 565Short Message Peer-to-Peer (SMPP) protocol uses TCP protocol as its transfer for exchanging Short Message Service (SMS) Messages, mainly between Short Message Service Centers (SMSC). The dissector determines whether the captured packet is SMPP or not by using the heuristics in the fixed header. The SMPP Operations window displays the related statistical data. The user can filter, copy or save the data into a file. 566 567[[ChTelUCPMessages]] 568 569=== UCP Messages Window 570 571The Universal Computer Protocol (UCP) plays role in transferring Short Messages between a Short Message Service Centre (SMSC) and an application, which is using transport protocol, such as TCP or X.25. The UCP Messages window displays the related statistical data. The user can filter, copy or save the data into a file. 572 573[[ChTelH225]] 574 575=== H.225 Window 576 577H.225 telecommunication protocol which is responsible for messages in call signaling and media stream packetization for packet-based multimedia communication systems. The H.225 window shows the counted messages by types and reasons. The user can filter, copy or save the data into a file. 578 579[[ChTelSIPFlows]] 580 581=== SIP Flows Window 582 583Session Initiation Protocol (SIP) Flows window shows the list of all captured SIP transactions, such as client registrations, messages, calls and so on. 584 585This window will list both complete and in-progress SIP transactions. 586 587Window has same features as <<ChTelVoipCalls,VoIP Calls>> window. 588 589[[ChTelSIPStatistics]] 590 591=== SIP Statistics Window 592 593SIP Statistics window shows captured SIP transactions. It is divided into SIP Responses and SIP Requests. In this window the user can filter, copy or save the statistics into a file. 594 595[[ChTelWAPWSPPacketCounter]] 596 597=== WAP-WSP Packet Counter Window 598 599The WAP-WSP Packet Counter menu displays the number of packets for each Status Code and PDU Type in Wireless Session Protocol traffic. The user can filter, copy or save the data into a file. 600 601// End of WSUG Chapter Telephony 602