I've run into a quirky RTP implementation that generates a new SSRC after 256 packets for any given flow, which causes Wireshark to treat each flow->SSRC pair as a separate stream. i.e a 60 second call will show up as 12 unique streams under Telephony->RTP->Show All Streams. This is fine for a quick scan of stats, but is a real pain when attempting to export a stream to .au or .raw format for audio playback. Is there a way to combine these streams into one in tshark or Wireshark? |
From RFC 1889:
So I'd say that application isn't compliant to the RFC so in principle there is nothing to be done in Wireshark to cater for it. Believe me, I'm not going to argue that anyone or anything should bend to accommodate this RTP implementation. I was just hoping that there was some kind of clever work around that would make life a little easier.
(20 Sep '10, 11:04)
grossman
|
Wireshark would need a mixer functionality to handle this properly. Currently it can't. |