T.38 Real-time facsimile (T.38)

The T.38 protocol is used for Fax-over-IP; it is a member of the VOIPProtocolFamily.



Protocol dependencies

Example traffic

(Example traffic)


There is some known problems with decoding of T.38 traffic. Normally Wireshark will not decode T.38 packets as T.38 automatically. You may then need to use the "Decode As" functionality in Wireshark.

There may also be some problems with T.38 packets being decoded as RTP packets with version 0. You may then need to disable H.245 or SDP protocol before using "Decode As" functionality.

Preference Settings

There are incompatible T.38 ASN.1 specifications. Wireshark cannot automatically know which ASN.1 specification is used, so you have to specify whether to decode based on "pre-corrigendum" ASN.1 specification or not.

Example capture file

There is a sample SIP/RTP/T.38 capture on the following web-page with a description: http://www.cantata.com/support/productinfo.cfm?frmProduct=TR1034&frmCategory=Knowledgebase&frmKnowBaseID=1983&Level=2

(Note: this example actually uses UDP/UDPTL for the fax page transmission, RTP is present only initially during call setup)

Display Filter

A complete list of T.38 display filter fields can be found in the display filter reference

Show only the T.38 based traffic:


Capture Filter

You cannot directly filter T.38 protocols while capturing. However, if you know the TCP or UDP port used (see above), you can filter on that one.

External links

(External links)


Imported from https://wiki.wireshark.org/T38 on 2020-08-11 23:26:21 UTC