# Capture Network Packets

When calls fail in ways that are hard to explain, a packet capture gives you the raw evidence. The Ethernet Capture Tool records the network traffic passing through Cloud Voice so you can trace exactly what happened on the wire. It is most useful for problems such as extensions that will not register, calls with missing or one-way audio, and VoIP (Voice over IP, the technology that carries calls over a data network) trunks that drop or reconnect at random.

The goal is to record traffic while the fault is happening, so plan to reproduce the issue during the capture. A capture taken after the problem has passed will not contain anything useful.

## Capture packets

1. Sign in to the phone system web portal and open **Maintenance > Troubleshooting > Ethernet Capture Tool**.
2. Click **Start**. Capturing begins immediately.
3. While the capture is running, reproduce the problem on the affected trunk or extension (for example, place the call that loses audio or restart the extension that fails to register).
4. Click **Stop** once you have reproduced the issue. The recorded traffic is written to the phone system's local storage.
5. Click **Download** to save the capture file to your computer.

:::tip
Keep the capture as short as you can. Start it, trigger the fault, and stop it right away. A tight recording is far quicker to sort through than one that ran for several minutes.
:::

:::caution
A packet capture can contain sensitive information, including SIP account credentials and the audio of live calls. Save the downloaded file somewhere secure, share it only through a trusted channel when you send it for support, and delete it once you no longer need it.
:::

## What you get

The download is a `.tar` archive containing a single `.pcap` file. The `.pcap` holds the captured packets and is the file you open for analysis.

## Analyze the capture

1. Extract the `.tar` archive to reveal the `.pcap` file inside.
2. Open the `.pcap` file in a packet analyzer such as [Wireshark](https://www.wireshark.org/download.html).
3. Inspect the two parts of each call: the SIP (Session Initiation Protocol, which sets up, controls, and ends the call) signaling, and the RTP (Real-time Transport Protocol, which carries the call audio). Registration failures and one-way audio usually show up here as messages that are missing, rejected, or never answered.