This is a sample Wireshark File.

Below is a sample wireshark file

Notice how the screen is divided into two panes.  The top portion will show you Q931 messages (i.e. SETUP, CONNECT, DISCONNECT). When clicking on each one, the bottom pane describes the details of each message. You will have to expand the fields on the bottom pane to view details.

Notice the source and destination Columns.  This tells you where the call originated from and is being sent to, respectively.  If source = ‘Local User’ this means your server made an outgoing call. If source = ‘Remote Network’ this means an incoming call was made to your server.

A successful call will contain all will include all of the following msg in the following orde :

  1. SETUP : Caller sends the SETUP
  2. CALL PROCEEDING : If the SETUP was ok,CALL Proceeding is sent to the caller and then a SETUP to receiver
  3. ALERTING : The receiver receives the SETUP and if ok it rings the phone and sends an alerting msg.
  4. CONNECT : when reciver attends the call it sents a CONNECT msg and this msg is forwarded to the caller
  5. CONNECT ACK : The caller sends the CONNECT ACK msg which is then forwarded to the receiver.
  6. DISCONNECT : whichever party wants to disconnect the call sends this msg.which is then forwarded to the remote party.
  7. RELEASE : When the DISCONNECT messages are received by any recipient, it disconnects the call from its side, and sends a RELEASE to the Switch, which forwards it to the other side.
  8. RELEASE COMPLETE : The party who receives the RELEASE sends a RELEASE COMPLETE to acknowledge  the end of the entire call.

Analysing a Call Disconnect

As seen in the picture above, by expanding the fields in the lower pane, we can see the Cause for the call disconnect was "Normal call clearing”  16 is the ISDN cause code, and can be referenced on the internet to investigate details.