📄 How to Detect Encrypted VoIP & Solutions (Use VCT First)
Sign in

Encrypted SIP Solutions — How to Detect and Resolve VoIP Encryption Issues

The Vertex requires unencrypted SIP to read caller ID. If your VoIP provider uses TLS/SRTP encryption, the Vertex will not capture any call data. This article explains how to determine if your VoIP line is encrypted and what solutions are available.

Step 1: How to Determine If Your VoIP Line Is Encrypted — Using VCT (Vertex Configuration Tool)

The Vertex Configuration Tool (VCT) is the primary tool for detecting whether your VoIP line is encrypted. If you do not have VCT installed on your computer, download it from the CallerID.com website:

Download: Visit vct.callerid.com to download the latest Vertex Configuration Tool (VCT 6.0.6.0 or later).

VCT Encryption Detection Procedure

  1. Open the Vertex Configuration Tool (VCT). At startup, the VCT will ask if you want to run the wizard — select NO.
  2. Connect to the Vertex unit. The VCT will discover the Vertex on the local network and display its IP address.
  3. Check for an encryption warning. The VCT will automatically detect encrypted VoIP traffic (TLS/SRTP) and display a warning message if encryption is present. If you see this warning, your VoIP provider is using encryption and the Vertex cannot read Caller ID data on this line.
  4. Use the Advanced capture mode to verify. In the upper right corner of the VCT window, there is a button labeled "L" (Locked). Right-click to unlock, then click "Advanced" to enter advanced mode.
  5. Capture traffic. Make an outbound call from any phone on the VoIP network. The VCT will capture the data traffic flowing through the Vertex bridge ports. After about 30 seconds, stop the capture.
  6. Review the capture. If the capture shows SIP INVITE packets with caller ID data, the line is NOT encrypted and the Vertex should work. If the capture shows no recognizable SIP data, TLS-wrapped packets, or the VCT displays an encryption warning, the line IS encrypted and you need one of the solutions below.

IMPORTANT: Always start troubleshooting with VCT. It is the fastest way to determine if encryption is the issue. Do not skip this step.

Additional Verification with Wireshark (Optional — For Advanced Users)

For a deeper analysis, you can export a capture from VCT and open it in Wireshark (a free network analysis tool downloadable from wireshark.org):

  1. In VCT Advanced mode, after capturing traffic, click the copy/save button to save the capture file to your desktop.
  2. Open the file in Wireshark.
  3. Apply this filter to isolate SIP/VoIP traffic: tcp.port == 5061 || tcp.port == 5060 || udp.port == 5061 || udp.port == 5060 || rtp || sip
  4. If you see readable SIP INVITE packets with From/To headers, the traffic is unencrypted and the Vertex should work.
  5. If you see TLS handshakes on port 5061 or encrypted payloads, the line is encrypted.
  6. Wireshark will also show the SIP Gateway MAC address, which may be needed to configure the Vertex correctly (see Troubleshooting section below).

Step 2: Solutions If Your Line IS Encrypted

If VCT confirms your VoIP line is encrypted (TLS/SRTP), use one of these solutions:

Option A: Ask Your VoIP Provider for Unencrypted SIP

Some VoIP providers can deliver unencrypted SIP on the LAN side while maintaining encryption on the WAN/internet side. Contact your provider's technical support and ask them to disable TLS/SRTP for the local network segment. This is the simplest solution when available.

Option B: ATA Adapter (Analog Telephone Adapter)

Use an ATA (such as the Grandstream HT802) to convert the VoIP signal to analog. The ATA decrypts the SIP traffic internally and outputs a standard analog phone signal, which a Whozz Calling or POS unit can read.

  1. Connect the ATA to the network via Ethernet
  2. Register the ATA with your VoIP provider (enter SIP credentials in the ATA's web interface)
  3. Verify dial tone on the ATA's phone port (FXS port)
  4. Connect the ATA's phone port to the CallerID unit's LINE IN via RJ11 cable
  5. Enable Caller ID delivery in the ATA settings (FXS Port settings → enable Caller ID)

Note: When using an ATA, you will use an analog Whozz Calling or POS unit instead of the Vertex, since the signal is converted back to analog.

Option C: EdgeMarc Session Border Controller (SBC)

Deploy an EdgeMarc SBC to decrypt SIP traffic on the LAN side. The Vertex connects between the EdgeMarc and the phones, seeing unencrypted SIP after the SBC decrypts it. This is the preferred enterprise solution that allows you to keep using the Vertex with VoIP phones.

Troubleshooting: SIP Gateway MAC Address Configuration

If the Vertex is connected but not showing Caller ID data even though the line is NOT encrypted, the SIP Gateway MAC address may need to be corrected in VCT. This tells the Vertex which network device is the VoIP gateway so it knows which SIP traffic to monitor.

How to Find and Set the Correct Gateway MAC Address Using VCT and Wireshark

  1. Open VCT and enter Advanced mode (right-click the "L" button to unlock, then click "Advanced").
  2. Capture traffic by making an outbound call from any restaurant/office phone on the VoIP network. Wait about 30 seconds, then stop the capture.
  3. Save the capture file to the desktop and open it in Wireshark.
  4. Apply the SIP filter: tcp.port == 5061 || tcp.port == 5060 || udp.port == 5061 || udp.port == 5060 || rtp || sip
  5. In the Wireshark capture, identify the MAC address of the SIP gateway (the device sending SIP INVITE packets to the phones). This is typically labeled as the gateway or router manufacturer name.
  6. If this MAC address is different from what the VCT wizard originally detected, go back to VCT and click "Main" to return to the IP and MAC address area.
  7. Click "SIP Gateway MAC" and type in the correct MAC address found in Wireshark.
  8. Click "Save All to Vertex" to program the new MAC address to the unit.
  9. Wait for the save to complete, then go to "Monitor Call Records" and make a test inbound call to verify the Vertex is now receiving data.

Quick Diagnostic Checklist

  1. Download and open VCT — visit vct.callerid.com if you don't have it installed
  2. Connect to Vertex and check for encryption warnings
  3. If encrypted → use Option A (ask provider), Option B (ATA), or Option C (EdgeMarc SBC)
  4. If NOT encrypted but no Caller ID → verify SIP Gateway MAC address using VCT + Wireshark
  5. If Caller ID appears in VCT Monitor but NOT on POS → the Vertex is working correctly; check the Management Port data cable connection to the POS network

Frequently Asked Questions

Q: How do I know if my VoIP line is encrypted?

Download and open the Vertex Configuration Tool (VCT) from vct.callerid.com. Connect to your Vertex and VCT will automatically detect and warn you if encrypted VoIP traffic (TLS/SRTP) is present. This is the fastest and most reliable way to check.

Q: Where do I download the Vertex Configuration Tool?

Visit vct.callerid.com to download the latest version of VCT. It is available for Windows. The current version is 6.0.6.0 or later.

Q: Can the Vertex work with encrypted SIP (TLS/SRTP)?

No. The Vertex is a passive network tap that reads unencrypted SIP packets. It cannot decrypt TLS or SRTP traffic. If your provider uses encryption, you need one of the solutions listed above (request unencrypted SIP, use an ATA, or deploy an EdgeMarc SBC).

Q: My VCT shows traffic but the Vertex isn't reporting Caller ID. What's wrong?

The most common cause is an incorrect SIP Gateway MAC address. Use VCT's Advanced capture mode and Wireshark to identify the correct gateway MAC address, then update it in VCT and save to the Vertex.

Q: The Vertex shows Caller ID in VCT's Monitor tab but my POS doesn't show anything. Is the Vertex broken?

No — if Caller ID appears in VCT's Monitor, the Vertex is working correctly. The issue is with the data connection between the Vertex's Management Port and the POS system. Check that the Management Port Ethernet cable is properly connected and that the POS is on the same network subnet as the Vertex's Management Port IP address.