This is our old Q&A Site. Please post any new questions and answers at

I tried this script and I get a csv file with all content except the RTP sequence number. I've already used "-e rtp.seq":

tshark -Y "udp.srcport == 2346" -T fields -n -r "C:\not_land.pcap" -E separator=, -e ip.src -e ip.dst -e ip.proto -e udp.srcport -e rtp.seq >> "C:\not_land.csv"

Is there any problem with this command?

asked 28 Apr '15, 00:05

DiveDave's gravatar image

accept rate: 100%

Either use Wireshark to set the preference 'Try to decode RTP outside of conversations' or pass it in via the command line.

permanent link

answered 28 Apr '15, 09:07

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Thanks for helping. I solved this problem by adding "-o rtp.heuristic_rtp:TRUE" in my command :)

(30 Apr '15, 04:20) DiveDave
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Apr '15, 00:05

question was seen: 1,822 times

last updated: 01 May '15, 01:50

p​o​w​e​r​e​d by O​S​Q​A