How do you capture RTP packets?

Question

I'm trying to capture RTP streams. When I use rtp as a packet filter Wireshark says "Invalid capture filter: "rtp"!" What port does RTP use?

Accepted Answer

RTP port numbers are usually dynamically assigned. You can use something like this to get close enough in most cases:

udp[1] & 1 != 1 && udp[3] & 1 != 1 && udp[8] & 0x80 == 0x80 && length < 250

It does the following:

udp[1] & 1 != 1 && udp[3] & 1 != 1 - even source and destination UDP ports
udp[8] & 0x80 == 0x80 - a valid RTP version
length < 250 - look for small packets.

This will capture any non-RTP traffic that happens to match the filter (such as DNS) but it will capture all RTP packets in many environments.

Answer 2

This likely (hopefully) causes RTP session establishment signaling to be filtered out, so make sure to set 'Try to decode RTP outside of conversations' in the RTP dissector preferences. Otherwise you'll only see UDP packets.

Answer 3

It could even be

udp[8] & 0xC0 == 0x80

to check for a valid RTP version (2).

The length could be tuned even further, starting at 225 for untagged 20 ms G.711 audio @ 8kbps, adding 80 bytes per 10 ms extra. Other features (SRTP, RTP extensions) and other codecs (G722, G729, etc) require other sizes.