This is our old Q&A Site. Please post any new questions and answers at

Why do DTMF events (pressing key on phone) not show up in Wireshark capture of a Cisco IP phone. I press various keys during the phone menu after a call connects, but they don't show up. The call and menu choices were successfully completed.

asked 19 Feb '13, 07:41

RAS's gravatar image

accept rate: 0%

Some questions:

  1. what is your Wireshark version?
  2. do you encrypt the SIP and RTP communication?

Some hints:

If there are DTMF signals in SIP INFO packets, you will find them with this Display filter (uppercase M is intentional!): sip.Method == INFO. See the following capture file:

If there are DTMF signals in RTP EVENT packets, you will find them with this Display filter: rtpevent. See the following capture file:

If there are DTMF signals inband in the RTP audio stream, then they are just audio signals and your won't see them in Wireshark.


permanent link

answered 19 Feb '13, 08:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 19 Feb '13, 08:21

Your suggestion above was correct - I found them using sip.Method == INFO . Thank you for the help!

(19 Feb '13, 08:43) RAS

It depends on how the Cisco phone or system works it could send the key press evnts as out of band signaling or as tones in the RTP stream or RTP evnts you have to know which method is beeing used.

permanent link

answered 19 Feb '13, 08:08

Anders's gravatar image

Anders ♦
accept rate: 17%

I have tried "SIP INFO" (out of band) and "Inband" DTMF Transmit types and still nothing shows up in Wireshark. I search the capture for "DTMF" and no results appear.

(19 Feb '13, 08:11) RAS

Well then chanses are that the tone is sent in the voice channel.

(19 Feb '13, 08:17) Anders ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Feb '13, 07:41

question was seen: 41,572 times

last updated: 19 Feb '13, 08:43

p​o​w​e​r​e​d by O​S​Q​A