title: Strange flow DTMF capture on tcpdump
body: <p>I captured a tcpdump of a SIP call to debug DTMF problem (repeated digits), but I have some problem interpreting it.</p>
  
  <p>From what I understand, when I parse the captured traffic through wireshark's "VOIP CALL", I should see something like this (for digits 123) :</p>
  
  <p>CAPTURE 1<br>
  RTP telephone event DTMF One 1<br>
  (end of event)<br>
  RTP telephone event DTMF Two 2<br>
  (end of event)<br>
  RTP telephone event DTMF Three 3<br>
  (end of event)  </p>
  
  <p>But I'm seeing this instead<br>
  CAPTURE 2<br>
  RTP telephone event DTMF One 1<br>
  RTP telephone event DTMF One 1<br>
  RTP telephone event DTMF One 1<br>
  (end)<br>
  RTP telephone event DTMF Two 2<br>
  RTP telephone event DTMF Two 2<br>
  RTP telephone event DTMF Two 2<br>
  (end)<br>
  RTP telephone event DTMF Two 3<br>
  RTP telephone event DTMF Two 3<br>
  RTP telephone event DTMF Two 3<br>
  (end)  </p>
  
  <p>On 1 system, CAPTURE 2 is detected as 123, but on another system it seems to decode this as having repeated digits. What's the reason for wireshark not grouping them together as a single RTP event?</p>
  
  <p>This is the rtp traffic flow:<br>
  CAPTURE 1:  </p>
  
  <p>RTP EVENT DTMF 1<br>
  RTP EVENT DTMF 1<br>
  RTP EVENT DTMF 1 (end)<br>
  RTP EVENT DTMF 1 (end)<br>
  RTP EVENT DTMF 1 (end)<br>
  RTP EVENT DTMF 2<br>
  RTP EVENT DTMF 2<br>
  RTP EVENT DTMF 2 (end)<br>
  RTP EVENT DTMF 2 (end)<br>
  RTP EVENT DTMF 2 (end)<br>
  RTP EVENT DTMF 3<br>
  RTP EVENT DTMF 3<br>
  RTP EVENT DTMF 3 (end)<br>
  RTP EVENT DTMF 3 (end)<br>
  RTP EVENT DTMF 3 (end)<br>
  RTP PAYLOAD<br>
  ...<br>
  ...<br>
  ...<br>
  RTP PAYLOAD  </p>
  
  <p>whereas CAPTURE 2 is:<br>
  RTP EVENT DTMF 1<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 1<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 1 (end)<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 1 (end)<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 1 (end)<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 2<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 2<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 2 (end)<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 2 (end)<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 2 (end)<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 3<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 3<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 3 (end)<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 3 (end)<br>
  RTP PAYLOAD<br>
  RTP EVENT DTMF 3 (end)<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD<br>
  RTP PAYLOAD  </p>
  
  <p>Is CAPTURE 2 following RFC2833?</p>