T.38 Real-time facsimile (T.38)
The T.38 protocol is used for Fax-over-IP; it is a member of the VOIPProtocolFamily.
There is some known problems with decoding of T.38 traffic. Normally Wireshark will not decode T.38 packets as T.38 automatically. You may then need to use the "Decode As" functionality in Wireshark.
There may also be some problems with T.38 packets being decoded as RTP packets with version 0. You may then need to disable H.245 or SDP protocol before using "Decode As" functionality.
There are incompatible T.38 ASN.1 specifications. Wireshark cannot automatically know which ASN.1 specification is used, so you have to specify whether to decode based on "pre-corrigendum" ASN.1 specification or not.
Example capture file
There is a sample SIP/RTP/T.38 capture on the following web-page with a description: http://www.cantata.com/support/productinfo.cfm?frmProduct=TR1034&frmCategory=Knowledgebase&frmKnowBaseID=1983&Level=2
(Note: this example actually uses UDP/UDPTL for the fax page transmission, RTP is present only initially during call setup)
A complete list of T.38 display filter fields can be found in the display filter reference
Show only the T.38 based traffic: