FaxTap NG

The deployment of FoIP in service-provider and carrier networks is rapidly growing. But the readiness of the equipment or the network operators to handle FoIP in SIP networks is not growing as fast, creating the need for test tools to support monitoring, testing, troubleshooting, and analysis. Moreover, there is a pressing need for support for FoIP sessions in SIP networks for lawful intercept. FaxTap NG   meets the need for an affordable tool to perform these functions, and it’s developed and supported by Commetrex, the industry’s leading developer of fax and fax-related technologies.

FaxTap NG picks up where Wireshark leaves off. Wireshark does have SIP and a degree of T.38 analysis, but does not support any analysis for G.711 modem pass-through calls. Further, the analysis it does provide is not always accurate.  Its identification of packets following a T.38 re-Invite as T.38, even if they are RTP, can lead to misinterpretation (flags them as “Malformed T.38 packets”). It interprets HDLC image frames during ECM transmissions as if they were T.30 negotiation frames. Of course, Wireshark performs only limited T.30 protocol analysis, and doesn’t render the image for you. Finally, the user must switch between the versions of T.38 manually.


  • T.38 version 0, 1, 2, and 3 with V.34
  • UDPTL, TPKT, and TCP sessions
  • G.711 pass-through RTP with V.34
  • Modem equalizer measurements (MSE)
  • Windows and Linux 32- and 64-bit support
  • V.21, V.27ter, V.29, V.17, V.8 and V.34 modems included
  • ECM frame, block, and page analysis
  • Faster than real time
  • Comprehensive conversion report
  • Imaging rendering
  • Post real-time decoding
  • DLL/SO (OEM) or end-user versions
  • Comprehensive page analysis
  • Bad-line repair
  • SIP ladder diagram output
  • T.30 ladder diagram output
  • Analysis component available for OEMs
  • Supports µ-law, A-law, 13- and 16-bit linear
  • NSF/NSS support
  • Polling
  • New GUI

User Manuals

The following manuals are available for download in PDF format:

    • FaxTap NG OEM Manual
    • FaxTap NG  User Manual


FaxTap NG will extract SIP FoIP sessions, both G.711 RTP and T.38 version 0. 1, 2, or 3, from a PCAP, render the image, producing a TIFF-F file, and provide supporting SIP and T.30 session analysis. It performs image analysis to report bad lines and provides ECM frame analysis. FaxTap NG includes V.21, V.27er, V.29, V.17, and V.34 modems.

FaxTap NG is available in stand-alone end-user and OEM versions. The SDK for the OEM version includes separate libraries for:

  • SIP call extraction
  • Fax session analysis
  • Ladder diagram printing of session analysis.

The OEM can combine these libraries for use in his product. For example, an OEM could replace the SIP call extraction with a custom module that extracts a T.38 or G.711 session from other network protocols or replaces the ladder diagram package with a graphical output. These libraries are the same as used in Commetrex’ FaxTap NG product.

PCAP Analysis

The FaxTap NG executable will accept as input a TCP/IP or UDP packet capture in PCAP format and produce a textual summary of all FoIP SIP calls present in the recording, a SIP ladder diagram, and the fax image if able to do so. FaxTap NG will accomplish this via a command-line utility that uses a C/C++ callable library that contains the conversion routines.

The OEM SDK version also includes libraries that directly accept a PCM recording.

Modem-Analysis Library

In addition to its accepting a PCAP as an input for the complete package, the analysis portion of FaxTap for NG can be separated to accept the following inputs:

  • Single PCM file (µ-law, A-law, 13- or 16-bit linear) with transmitter, receiver, or both. (image only rendered if transmitter output present)
  • Dual files: one with transmitter and one with receiver.
  • Single-sided T.38 session (image rendered only if transmitter output is present.)
  • Double-sided T.38 session

The libraries will produce the following:

  • Extracted images (if present) in a TIFF file,
  • T.30 session trace as a linked list of events,
  • Cumulative statistics for the session,
  • Analysis of each T.38 frame (optional output)

Design Overview

FaxTap NG is built around a T.30 protocol engine re-purposed to monitor, rather than participate in, a fax session. In G.711 mode, the modems decode signals in the recordings into modem events and data that are used to drive the protocol engine. The engine builds a list of session events that include the T.30 frames recovered from the session and outputs the image data to a multi-page TIFF-F file. For V.34 recordings a special monitor-only version of the V.8 and V.34 modems are used to decode the recordings.

In T.38 mode, a T.38 frame decoder converts the T.38 frames into “modem” signals and data that mimic those produced by G.711 modems. These events and data drive the protocol engine as previously described. In T.38 mode, optional T.38 frame decoding structures can be generated for each frame. The structure allows the OEM to display the T.38 packets in readable format without processing the ASN.1 encoding.

FaxTap NG automatically configures the analysis package for the negotiated T.38 version.


Inputs: PCAP-formatted captures, direct PCM recordings

Signaling Protocol: SIP

Media Protocols: T.38, UDPTL, TPKT, TCP

Media Formats: RTP, µ-law, A-law, 13-bit linear, 16-bit linear

Modems: V.8, V.21, V.27ter, V.29, V.17, V.34

Outputs: TIFF-F, SIP ladder diagram, T.30 ladder diagram, synopsis


ABOVE: FaxTap NG Functional Diagram

    The topmost module is responsible for parsing a PCAP file to idenfity the FoIP calls. It passes the G.711 pass-through calls the the G.711 Processing module; T.38 streams are passed to the T.38 processing module. There is also an OEM interface (not shown) between the FaxTap NG module and the two processing modules to support the direct analysis of non-PCAP inputs, PCM recordings, for example.

The two processing modules utilize Commetrex 19-years-in-the-field T.38 protocol engine (state machine). It sequences the modems and produces the image and events through the ECM, image-conversion library (ICL) and the event-logging package.