How to decode the UDP to RTP in command line?

Question

Hi all,

Under the Wireshark GUI, I am able to decode the UDP to RTP by using the

"Analyze > decode as..."

. However, for the command line, I am not able to do it

tshark -r c:\input.cap -d udp.port==20390,rtp -w c:\output.cap

it runs without error but after I open the output.cap in Wireshark GUI, the problem is all the frames are still UDP. Seems the file not change?? Anybody could help?

Thanks Sam

Answer 1

From the Wireshark GUI set the RTP dissector preference: Try to decode RTP outside of conversations.

or

Add -o rtp.heuristic_rtp:TRUE to your command line.