GOV: Realtime Transport Pi (RTPi)

A Decade Changes Things

Sometime over ten years ago was the first time I remember taking part in the conversation regarding a VoIP “break-back” box. At that time decoding digital phone streams were trivial given you had the proper CODEC, and VoIP phones could be decoded as well. The issue was decoding VoIP in real time.

Anyone with some networking knowledge and Wireshark can determine how to capture traffic and play it back, but real time playback was just out of reach. My coworkers and I had talked with different vendors that claimed it was possible and one even showed a demonstration. However, when it came to price, the $500 unit we had seen quickly ballooned to add an extra zero.

A decade later and now not only is a solution available, but it’s low cost and accessible to anyone. The solution I propose below uses some very low cost parts to accomplish the very base level of functionality.

What It Does

The RTPi will listen on the line and light up LEDs anytime it sees RTP traffic. Additionally, it will decode that traffic and play it through the headset as audio. The ideal case is to put this inline with a single phone to ensure the phone is only sending RTP traffic when it is expected to do so. There are a few left and right boundaries. 

  • The RTPi will only decode one side of the conversation well. If you put the device on a mirrored port, it will show you when when RTP traffic flows through the switch, however the audio will not be very distinguishable because it has difficulty playing multiple RTP streams. If using a mirrored port ensure you are only pushing the outgoing stream from the phone to the decoding device.
  • For ideal use, connect the device to a passive network tap. In this manner the device will only receive one RTP stream and will play the audio correctly.
  • The filter being used to detect RTP is good but is not all encompassing. For instance, although rare, there exists the possibility that a single DNS packet could cause the lights to momentarily blink. If a blink does occur it should be an isolated and should not continue for minutes on end.
  • The RTPi will not decode encrypted RTP traffic.

I suspect that future versions will alleviate some of the restrictions outlined above. If you have any functionality requirements, just let me know and I’ll add it to the list.

Parts List

Below is a list of parts you’ll need to get everything going. You will not need all of this for the operation of the device. Some of these items, like the mouse and keyboard, are just for installation. The amazon links are affiliate links. If you wish to have the RTPi fully built with the programming already done, you can order it from here:


  • Install the Raspbian image on to an SD card.
  • Insert the micro SD card into the Raspberry Pi.
  • Connect the HDMI cable (with monitor attached), mouse, and keyboard to the Pi. Also, connect the Pi to a network switch with Internet access.
  • Connect the micro USB power adapter to the Raspberry Pi to power it on.
  • Go through the Pi setup process and answer each question appropriately. Be sure to select the check box to use a US keyboard. There is no need to setup the wireless interface if you wish to skip this step. The update installation may take awhile.
  • Once the setup is complete, reboot the system.
  • After reboot click on the Pi button in the upper left corner of the screen.  Choose Preferences and then Raspberry Pi Configuration.
  • Click the Interfaces Tab and Enable SSH. This will allow you to remote into the Pi and administer it if there is no monitor available. Click the OK button.
  • Click the Pi button again. Choose Accessories and then Terminal.
  • In the Terminal windows type the following and press Enter:
  • Note the IP address that has been assigned to the eth0 interface. You may use this IP address to remotely administer the Pi while on this network. If you wish to statically assign a new IP address to the Raspberry Pi, follow these instructions:
  • Next, we’ll load the software needed for the Blinkt LED strip. Type the following in the Terminal window and press enter. Press Y and then Enter whenever asked.
curl | bash
  • Let’s make the rtpled working directory. Click on the file folders in the top left of the screen. You should be viewing the /home/pi folder.
  • Right click on the right side of the File Manager windows. Go to Create New and create a Folder called:
  • Close out the folders window and go back to the terminal window.
  • Install tcpdump by typing the following and pressing Enter. Press Y followed by Enter when asked any questions.
sudo apt-get install tcpdump
  • Next we’ll install a python packet capturing mechanism call scapy. Type the following and press Enter.
sudo pip install scapy
  • Next, direct the Pi’s audio to the headphone jack and not the HDMI interface by typing the following and press Enter.
amixer cset numid=3 1
  • Next we need to create a named pipe for the audio to flow through. Type the following press Enter after each line:
cd rtpled
mkfifo rtppipe
  • Click the Pi button. Choose Accessories and the Text Editor. Paste or type the following code into the editor window. You can access this webpage via your Pi by clicking on the Web Browser icon next to the Pi button if you choose to Copy and Paste the code.
#! /user/bin/python
from scapy.all import *
import threading, Queue
import os, time, sys
from subprocess import call
from blinkt import set_pixel, set_brightness, show, clear
pipeout ="/home/pi/rtpled/rtppipe", os.O_WRONLY)
def blinkit(q):
while True:
if (q.qsize()>0):
if (j>=7):
def gather(q):
sniff(iface=sys.argv[1],filter="udp[1] & 1 != 1 && udp[3] & 1 != 1 && udp[8] & 0x80 == 0x80 && length < 250",store=0,prn=lambda x: q.put(x))
def sendout(q):
while True:
if (q.qsize()>0):
q = Queue.Queue()
Gat = threading.Thread(target = gather,args=(q,))
Sendit = threading.Thread(target = sendout,args=(q,))
Blink = threading.Thread(target = blinkit, args=(q,))
  • Save the file using the following name and in the rtpled directory made earlier. You will find the folder in the pi directory. Close the application.
  • Next, add code to the boot sequence. In the Terminal window type the following:
sudo nano /etc/rc.local
  • Paste or type the following code right before the last line of the file. (Before Exit 0)
t1=$(ip a | grep -o eth1 | head -1)
if [ "$t1" = "$t2" ]; then
sudo python /home/pi/rtpled/ eth1 &
sudo python /home/pi/rtpled/ eth0 &
aplay -t raw -c 1 -f MU_LAW -r 8000 /home/pi/rtpled/rtppipe &
  • Press Ctrl+O. Press Enter. Press Ctrl+X to exit the text editor.
  • Click the Pi button and Shutdown the Pi. Installation is complete. The next time you reboot, the Pi will automatically be running the necessary programs to detect and decode RTP traffic.

Using the Decoder

  1. Connect the phone under test through the network tap. If the phone is PoE driven, let it boot.
  2. Ensure the micro SD card is inserted in the Pi.
  3. Insert the Blinkt on to the Pi.
  4. Connect the desired side of the tap to the Ethernet connector of the Pi.
  5. Power the Pi using the USB Power Adapter.
  6. Connect the headphones to the Pi.
  7. Wait 2 to 3 minutes after booting before making a test call.

I’ve found the Pi responds way better if a Gigabit USB Ethernet Adapter is used in lieu of the native adapter. Also, if there is a desire to connect to the Pi over the network during its operation, then step 4 can be modified by doing the following.

  • Connect the USB Ethernet Adapter to the Pi. Connect the transmit side of the tap to the USB Ethernet Adapter. If you desire network connectivity, connect the network switch port to the native Ethernet jack on the Pi. 

Always remember to connect the Pi to power after arranging your Ethernet setup.

Questions & Troubleshooting

This section will continue to grow is issues arise. Check in if you are having issue.

How do I stop the program from running?

Type the word top and press Enter. At the top of the list you will see a program running called python. There will be a PID number associated with this program. Take that number and insert it into the following command leaving out the brackets.

sudo kill <PID>

I want to run the python script without adding it to the rc.local boot file. What is the syntax?

Open a terminal over ssh or natively and type the following.

sudo python <interface> &

Where <interface> is be sure to put the interface you want to use as the monitoring interface. For example, eth1 for a USB adapter and eth0 for the native adapter.

Next, you’ll need to start the audio player.

aplay -t raw -c 1 -f MU_LAW -r 8000 /home/pi/rtpled/rtppipe &

There are no blinky lights on the on-board Ethernet port.

  1. Unplug the CAT5 cable from the port, wait until the phone under test has full network connectivity, and then re-plug the CAT5 cable to the port.
  2. If that didn’t work, unplug the Pi. Insert the USB Ethernet Adapter. Unplug the CAT5 cable and wait for the telephone to regain network connectivity. Insert the CAT5 into the USB Ethernet Adapter. Power on the Pi.

There are no blinky lights on the USB Ethernet adapter.

First unplug the CAT5 cable. Wait for the telephone to regain connectivity. Plug the CAT5 cable back in. If there are still problems, reboot your Pi.

The audio is intermittent and jerky even though I’m using the network tap.

If you installed scapy before tcpdump, the network interface will be painfully slow.

Also, if you are using the native Ethernet adapter, wait 2 to 3 minutes after the Pi boots before making the test call. If you can’t wait that long, use a USB Gigabit Ethernet adapter.

What is the most reliable, quick to start, setup?

Use the USB Gigabit Ethernet Adapter. For whatever reason, they adapter is far quicker and reliable that the native port.

Leave a Reply

Discover more from Skinny Research & Development

Subscribe now to keep reading and get access to the full archive.

Continue reading

Scroll to Top