I've come across a number of VoIP calls that when decoded in wireshark show an odd time distortion between the two audio legs. For instance leg A -> B shows audio beginning at 2 seconds and continues until 32 seconds. Leg A <- B shows a small amount of audio up until 2 second, then a yellow bar in the playback window, then no activity until say 35 seconds, another yellow bar, and then audio until 65 seconds. I see this fairly commonly, but it's perplexing, and for calls where the legs are this far off I'll usually export as RAW and then import into something like audacity and they play perfectly synced. Is there a reason this happens or anything I can do within wireshark to correct it? asked 29 Jan '13, 15:52  Mulloy |
One Answer:
Without having looked at the capture I would guess the RTP timestamps make an (illegal) jump. You ignore that part when you export raw audio and play that. Would you have an RTP player, you would see an event raised in the jitter buffer, as the playout engine has to skip through time. But that's what your VoIP equipment has to do to handle such non-compliant RTP streams. answered 01 Feb '13, 00:58  Jaap ♦ |
