T.38 Real-time facsimile (T.38)

The T.38 protocol is used for Fax-over-IP; it is a member of the VOIPProtocolFamily.

History

(History)

Protocol dependencies

• UDP: T.38/UDPTL uses UDP as its transport protocol. There is no well-known port for T.38.

• TCP: T.38 can also use TCP as its transport protocol. There is no well-known port for T.38.

• TPKT: T.38 can also use TPKT as its transport protocol when sent over TCP.

Example traffic

(Example traffic)

Wireshark

There is some known problems with decoding of T.38 traffic. Normally Wireshark will not decode T.38 packets as T.38 automatically. You may then need to use the "Decode As" functionality in Wireshark.

There may also be some problems with T.38 packets being decoded as RTP packets with version 0. You may then need to disable H.245 or SDP protocol before using "Decode As" functionality.

Preference Settings

There are incompatible T.38 ASN.1 specifications. Wireshark cannot automatically know which ASN.1 specification is used, so you have to specify whether to decode based on "pre-corrigendum" ASN.1 specification or not.

Example capture file

There is a sample SIP/RTP/T.38 capture on the following web-page with a description: http://www.cantata.com/support/productinfo.cfm?frmProduct=TR1034&frmCategory=Knowledgebase&frmKnowBaseID=1983&Level=2

(Note: this example actually uses UDP/UDPTL for the fax page transmission, RTP is present only initially during call setup)

Display Filter

A complete list of T.38 display filter fields can be found in the display filter reference

Show only the T.38 based traffic:

 t38 

Capture Filter

You cannot directly filter T.38 protocols while capturing. However, if you know the TCP or UDP port used (see above), you can filter on that one.

External links

(External links)

Discussion

Imported from https://wiki.wireshark.org/T38 on 2020-08-11 23:26:21 UTC