How does Wireshark determine the which RTP streams are part of a call. In a multiple stream PCAP, how does it determine who belongs to who? thanks Eric asked 24 Sep '12, 14:31  EricKnaus |
One Answer:
First of all SSRC stands for Synchronization Source Identifier in the context of RTP. It identifies the timestamping source used to, as you might have guessed, timestamp the RTP packets. Therefore it has nothing to do with SIP. But how then does Wireshark relate RTP sessions to SIP sessions? It looks in the SIP/SDP payloads for connection identifiers (IP address and port number), and defines so called conversations for them. answered 25 Sep '12, 06:20  Jaap ♦ |
