This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I'm writing a VoIP application and trying to verify correct RTP behavior with Wireshark. Unfortunately, Wireshark sees my packets as UDP only, it does not recognize them as RTP packets. What criteria does Wireshark use to determine RTP packets? Thanks.

asked 13 Feb '11, 10:15

cbwest's gravatar image

cbwest
1111
accept rate: 0%


Open the preferences, scroll down in the list of protocols, select RTP, check "Try to decode RTP outside of conversations".

permanent link

answered 13 Feb '11, 11:22

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Wireshark needs to see the signaling (SIP, MGCP, H.248, etc) associated with the VoIP call in order to determine which UDP packets are RTP. The signaling packets contain Session Description Protocol data, which tells the endpoints which IPs/ports to send RTP to. Wireshark in turn uses this SDP info to decode UDP packets matching those IP/port pairs as RTP.

It sounds like you either the signaling is not in the PCAP file or your signaling is being sent on a non-standard port. You can use the preferences setting in Jaap's answer to get around the former, or you can select a signaling packet and set a user specific decode via right-click -> Decode As -> Transport -> Both for the latter.

permanent link

answered 14 Feb '11, 11:08

grossman's gravatar image

grossman
16114
accept rate: 0%

Please note that:

  1. Wireshark doesn't need signaling, but can use signaling to tag UDP packet flows as possible RTP packet flows.
  2. Session Description Protocol (SDP) is just one of the possible signaling protocols to describe the media session. This is usually related to SIP and MGCP. Another media description protocols is H.245 f.i.
  3. Wireshark use the hint derived from the media description protocol to try to dissect the UDP packets as RTP. RTP is hard to heuristically discriminate from other UDP payloads, therefore the media description protocol dissection is helpful, while the RTP dissector preference helps out in other cases.
permanent link

answered 14 Feb '11, 14:36

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×166

question asked: 13 Feb '11, 10:15

question was seen: 45,626 times

last updated: 22 Apr '13, 23:52

p​o​w​e​r​e​d by O​S​Q​A