Capturing DTMF using Wireshark
Written by Mira Beltre
Updated at September 5th, 2025
Table of Contents
Scope
Intended Audience: T1 Technician, WLPs
This article goes over how to capture DTMF using a Wireshark PCAP
Requirements
- Access to Wireshark
- Open the Wireshark PCAP
- Filter on SIP packets
- Select Telephony > VoIP Calls from the Menu Bar
- Select your call and click Flow Sequence at the bottom of the screen
- This graphic will display the DTMF as RTP events.
Alternate Method
- Filter for rtpevent
- This method is not as clean as the previous method, but provides more detailed information.
- The DTMF key is not ended until you see the (end) event. (see the RED and GREEN highlights in the image above
- Clicking on a single line will provide additional information at the bottom of the wireshark app.