10169 packets captured
10169 packets received by filter
0 packets dropped by kernel
The number dialed was 18002729872, the IRS EFTPS IVR. The first voice prompt is to enter the 9-digit taxpayer identification number.
In Wireshark, I can clearly see the numbers being entered, as RFC2833 RTP DTMF events. One thing I notice is that I get several RTP packets for each digit. (I assume that's normal, but I'm new at this.) For example, here is one digit:
6507 87.427666 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2
6508 87.431287 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14414, Time=499365981
6509 87.447662 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2
6510 87.451285 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14415, Time=499366141
6511 87.467655 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2
6512 87.471284 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14416, Time=499366301
6513 87.487656 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2
6514 87.491286 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14417, Time=499366461
6515 87.507665 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2
6516 87.511285 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14418, Time=499366621
6517 87.527677 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2 (end)
6518 87.531284 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14419, Time=499366781
6519 87.547688 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2 (end)
6520 87.551336 192.168.4.1 192.168.4.235 RTP 214 PT=ITU-T G.711 PCMU, SSRC=0x71C6FAAF, Seq=14420, Time=499366941
6521 87.567658 192.168.4.235 192.168.4.1 RTP EVENT 60 Payload type=RTP Event, DTMF Two 2 (end)
This sequence happens 9 times with different numbers, as the 9-digit TIN is entered. At 80.5 seconds (according to the Wireshark player), the called party says: "The tax identification number must be nine digits. Please re-enter." The last digit event was at timestamp 2495866430 (phone) or 499404541 (FS). I don't know how to convert RTP timestamps to actual time.
What's the next step to diagnosing the problem?
--
Steve