Combining RTP streams for analysis

I've run into a quirky RTP implementation that generates a new SSRC after 256 packets for any given flow, which causes Wireshark to treat each flow->SSRC pair as a separate stream. i.e a 60 second call will show up as 12 unique streams under Telephony->RTP->Show All Streams.

This is fine for a quick scan of stats, but is a real pain when attempting to export a stream to .au or .raw format for audio playback. Is there a way to combine these streams into one in tshark or Wireshark?

asked 16 Sep '10, 05:25

grossman
16●1●1●4
accept rate: 0%

3 Answers:

active answers oldest answers newest answers popular answers

From RFC 1889:

Synchronization source (SSRC): The source of a stream of RTP packets, identified by a 32-bit numeric SSRC identifier carried in the RTP header so as not to be dependent upon the network address. All packets from a synchronization source form part of the same timing and sequence number space, so a receiver groups packets by synchronization source for playback. Examples of synchronization sources include the sender of a stream of packets derived from a signal source such as a microphone or a camera, or an RTP mixer (see below). A synchronization source may change its data format, e.g., audio encoding, over time. The SSRC identifier is a randomly chosen value meant to be globally unique within a particular RTP session (see Section 8). A participant need not use the same SSRC identifier for all the RTP sessions in a multimedia session; the binding of the SSRC identifiers is provided through RTCP (see Section 6.4.1). If a participant generates multiple streams in one RTP session, for example from separate video cameras, each must be identified as a different SSRC.

So I'd say that application isn't compliant to the RFC so in principle there is nothing to be done in Wireshark to cater for it.

permanent link

answered 17 Sep '10, 11:58

Anders ♦
4.6k●9●52
accept rate: 17%

edited 17 Sep '10, 12:20

Gerald Combs ♦♦
3.3k●9●22●58

Believe me, I'm not going to argue that anyone or anything should bend to accommodate this RTP implementation. I was just hoping that there was some kind of clever work around that would make life a little easier.

(20 Sep '10, 11:04) grossman

1	Wireshark would need a mixer functionality to handle this properly. Currently it can't. permanent link answered 16 Sep '10, 23:10 Jaap ♦ 11.7k●16●101 accept rate: 14%

0	You could export them all to separate files and then mix them in a program like Audacity. permanent link answered 23 Sep '10, 18:11 hmmwhatsthisdo 31●3●4●7 accept rate: 0%

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

rtp ×238
voip ×139
export ×76
audio ×25
telephony ×10

question asked: 16 Sep '10, 05:25

question was seen: 9,068 times

last updated: 23 Sep '10, 18:11

Combining RTP streams for analysis

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions