Read modules before packets
Start with the flow: source, DID, time condition, IVR choice, queue or extension, then final destination. A wrong module decision is configuration; a correct decision with failed signaling is transport or endpoint behavior.
Expand the relevant leg
The PCAP is optional paid evidence because it can contain phone numbers, headers and recoverable unencrypted audio.
- Compare SIP Call-ID and channel UUID.
- Check source IP, codec, media addresses and RTP counters.
- Use the redacted raw event for exact hangup and routing variables.
- Download the text diagnostic before requesting a PCAP.