I tried to find this in the documentation, but had no luck. I would love to dig the sources to find out, but I honestly don't have the time. I tried to google this, but either people do not get any reply (like this one or that one) or they look at the sources and the epiphany they get prevents them from sharing their newfound knowledge with the mere mortals we are (like here or there). Is the meaning behind "Difference" and "Delta" in Wireshark RTP analyses and graphs too much knowledge for the world to handle, or could we get a clear answer on that? (Also, do any of these relate to "Latency", and if not, is there a way to get the latency per packet from a capture?) Edit: I'm using version 1.2.11. asked 18 Jan '14, 12:26  Peniblec edited 18 Jan '14, 13:50  grahamb ♦ |
One Answer:
Ok, since I'm the one that committed the code I feel somewhat pressured to attempt to describe it ;) To really understand the behaviour of RTP one has to be comfortable with the concept of timebases. With timebases I mean clocks running at different nodes and protocol levels of the networked system. Between nodes of an RTP session (I assume a point-to-point session here) there are several relevant timebases. There are the sender RTP timestamper and packet sender clock on the one end and RTP receiver and playout clock on the other. Note: these are not necessarily in sync. Your Wireshark capture must be considered a point somewhere in between these nodes. It may be at the producer side (eg. in the gateway) or receiver side (eg. terminal), or somewhere in between (eg. intermediate network switch). What the RTP nodes try to do at the session level is to convey realtime data (eg. speech) at a specified rate. They produce RTP packets with an agreed encoding and time interval (=size) and timestamp these frames. Then they hand them off to the network stack to be transmitted to the other node. When this packet actually appears on the network may depend on various factors, but will probably be with varying delay. Then it has to traverse the network. This may also be with varying delay. Then it enters the receiver node network stack which will deliver it to the receiving RTP endpoint, also with varying delay. So, the receiver has to cope with all that varying delay, and try to sync its timebase to the transmitter. As you can imagine from this description there is only a so much you can do with the receive timestamp. The RTP timestamps should be the ones the receiving RTP node should work with. As you can see it's complex enough, and I won't even discuss the playout clock. Now that we're aware of the timing aspect of RTP we go back to the Wireshark RTP analysis' difference and delta. Delta is the difference between arrival of this packet vs. the arrival of the previous packet. It's all at the network layer and reflects the packet arrival at the capture interface (where it's timestamped). Difference tries to tell us something about the relationship between packet arrival and RTP timestamps. It's the (absolute) difference of the packet arrival at the capture interface (where it's timestamped) vs. the expected time of arrival of the packet at the capture interface based on the RTP timestamp. So, Delta is nice from a networking perspective, but for the RTP receiver the Difference is much more relavant since it influences the depth of the jitter buffer is must maintain to provide an uninterrupted playout. answered 20 Jan '14, 09:39  Jaap ♦ |
Okay, that did clear things up :) Sorry for the slight snark in the question, I was still recovering from the amount of people on the Internet who just assume that Delta and/or Difference are simply synonyms with Latency (i.e. time of arrival minus time of sending), since (I suppose) that's what they are looking for and they don't feel like digging too much (... I'm hardly one to talk, I guess).
(I posted the same question on superuser, if you're interested)
Well done, @Jaap!