I am using Wireshark to decode a UDP/RTP stream. I can set the "Decode as" to decode RTP based on the dest port. This is working fine. However, by default, Wireshark is decoding the RTP payload using RFC 2198 (Redundant Audio Data). So it is deciding to decode the RTP payload using RFC 2198 specs. How is it deciding to decode the RTP payload using RFC 2198? The Payload Type I am using is 99 which is a dynamic payload type. How do I prevent Wireshark from decoding the RTP payload using RFC 2198? My RTP stream carries video so I want to be able to select which RFC to use based on the RTP Payload Type. For example, I want to have Wireshark decode the RTP payload using RFC 2429 for H.263+ video. How do I get Wireshark to decode the RTP payload based on a dynamic payload type? If Wireshark cannot do that, can I at least fix the decode for the RTP payload based on dest port number like I do for RTP? In other words, I would like to set the RTP Payload Type "Decode as" just like I do for the UDP "Decode as RTP" Thanks, -Andres asked 25 Aug '12, 12:20  Andres |
One Answer:
The RTP dissector dissects PT 99 as RFC2198 by default(It probably should not), change it by going to edit->preferences->protocols->RTP in the menu bar. edit->preferences->protocols->H263P (aka H263+) also has a PT preference change that to 99. answered 26 Aug '12, 00:24  Anders ♦ |
Thanks for your response--just what I was looking for. -Andres
@Andres: if this is the correct answer please click the tick to that it's tagged as the accepted answer. That's how these Q&A sites are supposed to work.