The other day I found myself banging my head on the table to diagnose an issue with Ringback tone on an SS7 link and the IMS.
On the IMS side, no RBT was heard, but I could see the Media Gateway was sending RTP packets to the TAS, and the TAS was sending it to the UE, but was there actual content in the RTP packets or was it just silence?
If this was PCM / G711 we’d be able to just playback in Wireshark, but alas we can’t do this for the AMR codec.
Filter the RTP stream out in Wireshark
Inside Wireshark I filtered each of the audio streams in one direction (one for the A-Party audio and one for the B-Party audio)
Then I needed to save each of the streams as a separate PCAP file (Not PCAPng).
Turn into AMR File
With the audio stream for one direction saved, we can turn it into an AMR file, using Juan Noguera (Spinlogic)’s AMR Extractor tool.
Clone the Repo from git, and then in the same directory run:
python3 pcap_parser.py -i AMR_B_Leg.pcap -o AMR_B_Leg.3ga
Playback with VLC / Audacity
I was able to play the file with VLC, and load it into Audacity to easily see that yes, the Ringback Tone was present in the AMR stream!
Nick this is expert combination of Wireshark and audio tools such as Audacity. Please allow me to offer a way to avoid stream filtering and intermediate compressed file formats (.amr, 3GPP mime, etc), and directly generate wav output. For example using a publicly available AMR-WB pcap [1]:
mediaMin -cx86 -i codecs3-amr-wb.pcap -L -d0x0c11 -r20
will show:
Sessions (hSession:ch:codec-bitrate[,ch…]) 0(grp owner):0:AMR-WB-23850 1:2:AMR-WB-23850
SSRCs (ch:ssrc) 0:0xf7050fb8 2:0x4417176a
mediaMin auto-detects all RTP streams, including codec type, bitrate, header format, etc, and generates individual or “merged” wav files, independent of presence (or correctness) of SDP info
Disclaimer: I work for the company that created the mediaTest and mediaMin tools
[1] https://github.com/nesfit/Codecs/tree/master/PCAPs
Hello Jeff,
If i have a pcap with AMR and not AMR-WB, how does one extract the payload and be able to listen to that?
I did not get any resposne from Nick and I also tried contacting him privately.
Hello Nick,
My name is Petrus and I came across your blog while I have been looking at AMR Payload issue that I cannot seem to quite get to play no matter what I do. I have attempted your method but whenever I try to save the AMR packets from Wireshark, they automatically turn to UDP and when I run the script I get the below results
python pcap_parser.py -i AMR_A.pcap -o AMR_A.3ga
WARNING: Wireshark is installed, but cannot read manuf !
Number of packets read from pcap: 4785
AMR samples: 0, AMR-WB samples: 0, EVS samples: 0
Also I cannot seem to run it using python3 (which is the installed version).