Packet Captures and RTP Streams

There is really no difference - just the amount of time during which packets are collected - and consequently the size of the packet capture file.

By default, Wireshark should display RTP streams for SIP calls (provided the default SIP port 5060 is used at least by one endpoint involved in the call).

To get Wireshark to display RTP streams for calls to Nortel phones, you'd have to "tell Wireshark" that packets from the port 7000 of the UCx server should be decoded using the UNISTIM protocol (right click on one such packet, select Decode As and from the list pick Unistim). If that does not help, you might need to "tell Wireshark" what packets should be decoded as RTP.

If you don't use the default SIP port, you should "tell Wireshark" that packets from the non-default SIP port of the UCx server should be decoded using the SIP protocol.

Now, regarding the actual problem, did you make sure the system is configured correctly? Considering you have a hosted UCx, you must make sure that the jitter buffer is enabled for SIP phones and trunks as well as for Nortel phones. Go to PBX - PBX Configuration - SIP Settings and PBX - PBX Configuration - Nortel Settings pages and enable the jitter buffer. Without a jitter buffer, voice path impairments can be expected on a hosted system (the server is "remote" for all IP trunks and IP phones).