have you considered to temporarily disable the firewall and check if the call monitor works with a disabled firewall ?
If that works in a second step you can think of which ports to open.
Then the easy way would be to use a network sniffer.
The protocol is described here https://avm.de/fileadmin/user_upload/Global/Service/Schnittstellen/AVM_TR-064_first_steps.pdf
