This is our old Q&A Site. Please post any new questions and answers at

I've run into a quirky RTP implementation that generates a new SSRC after 256 packets for any given flow, which causes Wireshark to treat each flow->SSRC pair as a separate stream. i.e a 60 second call will show up as 12 unique streams under Telephony->RTP->Show All Streams.

This is fine for a quick scan of stats, but is a real pain when attempting to export a stream to .au or .raw format for audio playback. Is there a way to combine these streams into one in tshark or Wireshark?

asked 16 Sep '10, 05:25

grossman's gravatar image

accept rate: 0%

From RFC 1889:

Synchronization source (SSRC): The source of a stream of RTP packets, identified by a 32-bit numeric SSRC identifier carried in the RTP header so as not to be dependent upon the network address. All packets from a synchronization source form part of the same timing and sequence number space, so a receiver groups packets by synchronization source for playback. Examples of synchronization sources include the sender of a stream of packets derived from a signal source such as a microphone or a camera, or an RTP mixer (see below). A synchronization source may change its data format, e.g., audio encoding, over time. The SSRC identifier is a randomly chosen value meant to be globally unique within a particular RTP session (see Section 8). A participant need not use the same SSRC identifier for all the RTP sessions in a multimedia session; the binding of the SSRC identifiers is provided through RTCP (see Section 6.4.1). If a participant generates multiple streams in one RTP session, for example from separate video cameras, each must be identified as a different SSRC.

So I'd say that application isn't compliant to the RFC so in principle there is nothing to be done in Wireshark to cater for it.

permanent link

answered 17 Sep '10, 11:58

Anders's gravatar image

Anders ♦
accept rate: 17%

edited 17 Sep '10, 12:20

Gerald%20Combs's gravatar image

Gerald Combs ♦♦

Believe me, I'm not going to argue that anyone or anything should bend to accommodate this RTP implementation. I was just hoping that there was some kind of clever work around that would make life a little easier.

(20 Sep '10, 11:04) grossman

Wireshark would need a mixer functionality to handle this properly. Currently it can't.

permanent link

answered 16 Sep '10, 23:10

Jaap's gravatar image

Jaap ♦
accept rate: 14%

You could export them all to separate files and then mix them in a program like Audacity.

permanent link

answered 23 Sep '10, 18:11

hmmwhatsthisdo's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 16 Sep '10, 05:25

question was seen: 9,837 times

last updated: 23 Sep '10, 18:11

p​o​w​e​r​e​d by O​S​Q​A