This is our old Q&A Site. Please post any new questions and answers at

How does Wireshark determine the which RTP streams are part of a call. In a multiple stream PCAP, how does it determine who belongs to who?



asked 24 Sep '12, 14:31

EricKnaus's gravatar image

accept rate: 0%

First of all SSRC stands for Synchronization Source Identifier in the context of RTP. It identifies the timestamping source used to, as you might have guessed, timestamp the RTP packets. Therefore it has nothing to do with SIP.

But how then does Wireshark relate RTP sessions to SIP sessions? It looks in the SIP/SDP payloads for connection identifiers (IP address and port number), and defines so called conversations for them.

permanent link

answered 25 Sep '12, 06:20

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 Sep '12, 14:31

question was seen: 15,162 times

last updated: 31 May '13, 07:47

p​o​w​e​r​e​d by O​S​Q​A