Hello, I'm writing a VoIP application and trying to verify correct RTP behavior with Wireshark. Unfortunately, Wireshark sees my packets as UDP only, it does not recognize them as RTP packets. What criteria does Wireshark use to determine RTP packets? Thanks. asked 13 Feb '11, 10:15 cbwest |
3 Answers:
Open the preferences, scroll down in the list of protocols, select RTP, check "Try to decode RTP outside of conversations". answered 13 Feb '11, 11:22 Jaap ♦ |
Wireshark needs to see the signaling (SIP, MGCP, H.248, etc) associated with the VoIP call in order to determine which UDP packets are RTP. The signaling packets contain Session Description Protocol data, which tells the endpoints which IPs/ports to send RTP to. Wireshark in turn uses this SDP info to decode UDP packets matching those IP/port pairs as RTP. It sounds like you either the signaling is not in the PCAP file or your signaling is being sent on a non-standard port. You can use the preferences setting in Jaap's answer to get around the former, or you can select a signaling packet and set a user specific decode via right-click -> Decode As -> Transport -> Both for the latter. answered 14 Feb '11, 11:08 grossman |
Please note that:
answered 14 Feb '11, 14:36 Jaap ♦ |