RFC2833 was designed to carry DTMF signalling, other tone signals and telephony events in RTP packets.
This was later superseded by RFC4733, but everyone still referrers to this protocol as RFC2833, so I will too.
RFC2833 a special RTP payload designed to carry DTMF signalling information, so it operates on the same source / destination ports as the RTP signal and you’ll see it mixed in there when viewing packet captures.
It uses RTP’s Synchronisation Source Identifiers to identify the stream, and uses the next RTP sequence numbers, so it relies on RTP to sort pretty much everything.
The RTP Event itself, contains an Event ID header (called “event” in the spec), End of Event flag, Reserved flag, Volume header and Event Duration header.
Event ID (event)
The Event header contains the event that is being conveyed. For DTMF this would be the numeral 8 (8) for DTMF Eight.
End of Event
The End of Event (Referred to as E in the RFC) flag is set to 1 if the transmitted packet is the end of an RTP event.
This allows for a key press to span over multiple packets, with the end of the key-press (key release) denoted by this flag.
The reserved flag (R) is reserved for future use, and will just be set to 0.
This is only used for DTMF digits and denotes the volume of the tone in dB from 0 to -36 dBm0.
The event duration tag. When a DTMF keypress is split over multiple RTP Event packets, the first will start at 0 and then this will count up by the time incremented in the timestamp.
Analysing in Wireshark
By using the display filter “rtpevent” you can see all the RTP events for you call.
Each DTMF event will contain multiple packets, with the total number depending on how long the keypress is and packetization timers.
When they key is pressed by the user, an RTP event with a duration of 0 and the Event ID of the DTMF digit is sent.
For as long as the digit is held, subsequent packets with a totalled event duration will keep being sent,
Finally when the key is released an RTP Event with the “End of Event” header set to True will be sent to mark the end of the RTP Event.