This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Combining RTP streams for analysis

I've run into a quirky RTP implementation that generates a new SSRC after 256 packets for any given flow, which causes Wireshark to treat each flow->SSRC pair as a separate stream. i.e a 60 second call will show up as 12 unique streams under Telephony->RTP->Show All Streams.

This is fine for a quick scan of stats, but is a real pain when attempting to export a stream to .au or .raw format for audio playback. Is there a way to combine these streams into one in tshark or Wireshark?

telephony audio export rtp voip

asked 16 Sep '10, 05:25

grossman
16●1●1●4
accept rate: 0%

3 Answers:

From RFC 1889:

Synchronization source (SSRC): The source of a stream of RTP packets, identified by a 32-bit numeric SSRC identifier carried in the RTP header so as not to be dependent upon the network address. All packets from a synchronization source form part of the same timing and sequence number space, so a receiver groups packets by synchronization source for playback. Examples of synchronization sources include the sender of a stream of packets derived from a signal source such as a microphone or a camera, or an RTP mixer (see below). A synchronization source may change its data format, e.g., audio encoding, over time. The SSRC identifier is a randomly chosen value meant to be globally unique within a particular RTP session (see Section 8). A participant need not use the same SSRC identifier for all the RTP sessions in a multimedia session; the binding of the SSRC identifiers is provided through RTCP (see Section 6.4.1). If a participant generates multiple streams in one RTP session, for example from separate video cameras, each must be identified as a different SSRC.

So I'd say that application isn't compliant to the RFC so in principle there is nothing to be done in Wireshark to cater for it.

answered 17 Sep '10, 11:58

Anders ♦
4.6k●9●52
accept rate: 17%

edited 17 Sep '10, 12:20

Gerald Combs ♦♦
3.3k●9●22●58

Believe me, I'm not going to argue that anyone or anything should bend to accommodate this RTP implementation. I was just hoping that there was some kind of clever work around that would make life a little easier.

(20 Sep '10, 11:04) grossman

1	Wireshark would need a mixer functionality to handle this properly. Currently it can't. answered 16 Sep '10, 23:10 Jaap ♦ 11.7k●16●101 accept rate: 14%

0	You could export them all to separate files and then mix them in a program like Audacity. answered 23 Sep '10, 18:11 hmmwhatsthisdo 31●3●4●7 accept rate: 0%