Playing back AMR streams from Packet Captures

The other day I found myself banging my head on the table to diagnose an issue with Ringback tone on an SS7 link and the IMS.

On the IMS side, no RBT was heard, but I could see the Media Gateway was sending RTP packets to the TAS, and the TAS was sending it to the UE, but was there actual content in the RTP packets or was it just silence?

If this was PCM / G711 we’d be able to just playback in Wireshark, but alas we can’t do this for the AMR codec.

Filter the RTP stream out in Wireshark

Inside Wireshark I filtered each of the audio streams in one direction (one for the A-Party audio and one for the B-Party audio)

Then I needed to save each of the streams as a separate PCAP file (Not PCAPng).

Turn into AMR File

With the audio stream for one direction saved, we can turn it into an AMR file, using Juan Noguera (Spinlogic)’s AMR Extractor tool.

Clone the Repo from git, and then in the same directory run:

python3 pcap_parser.py -i AMR_B_Leg.pcap -o AMR_B_Leg.3ga

Playback with VLC / Audacity

I was able to play the file with VLC, and load it into Audacity to easily see that yes, the Ringback Tone was present in the AMR stream!

2 thoughts on “Playing back AMR streams from Packet Captures

  1. Nick this is expert combination of Wireshark and audio tools such as Audacity. Please allow me to offer a way to avoid stream filtering and intermediate compressed file formats (.amr, 3GPP mime, etc), and directly generate wav output. For example using a publicly available AMR-WB pcap [1]:

    mediaMin -cx86 -i codecs3-amr-wb.pcap -L -d0x0c11 -r20

    will show:

    Sessions (hSession:ch:codec-bitrate[,ch…]) 0(grp owner):0:AMR-WB-23850 1:2:AMR-WB-23850
    SSRCs (ch:ssrc) 0:0xf7050fb8 2:0x4417176a

    mediaMin auto-detects all RTP streams, including codec type, bitrate, header format, etc, and generates individual or “merged” wav files, independent of presence (or correctness) of SDP info

    Disclaimer: I work for the company that created the mediaTest and mediaMin tools

    [1] https://github.com/nesfit/Codecs/tree/master/PCAPs

  2. Hello Nick,

    My name is Petrus and I came across your blog while I have been looking at AMR Payload issue that I cannot seem to quite get to play no matter what I do. I have attempted your method but whenever I try to save the AMR packets from Wireshark, they automatically turn to UDP and when I run the script I get the below results

    python pcap_parser.py -i AMR_A.pcap -o AMR_A.3ga
    WARNING: Wireshark is installed, but cannot read manuf !
    Number of packets read from pcap: 4785
    AMR samples: 0, AMR-WB samples: 0, EVS samples: 0

    Also I cannot seem to run it using python3 (which is the installed version).

Leave a Reply

Your email address will not be published. Required fields are marked *