This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, I'm running wireshark on debian Wheezy on x86_64 machine. I've found that when wireshark is decoding UDP as RTP packets, it's decoding timestamp in RTP header incorrectly according to RFC3550 page 12:

4. Byte Order, Alignment, and Time Format All integer fields are carried in network byte order, that is, most significant byte (octet) first. This byte order is commonly known as big-endian.

and page 76:

    /*
    * RTP data header
    */
   typedef struct {
       unsigned int version:2;   /* protocol version */
       unsigned int p:1;         /* padding flag */
       unsigned int x:1;         /* header extension flag */
       unsigned int cc:4;        /* CSRC count */
       unsigned int m:1;         /* marker bit */
       unsigned int pt:7;        /* payload type */
       unsigned int seq:16;      /* sequence number */
       u_int32 ts;               /* timestamp */
       u_int32 ssrc;             /* synchronization source */
       u_int32 csrc[1];          /* optional CSRC list */
   } rtp_hdr_t;

As you can see on the screenshot, wireshark decodes timestamp "as is", without translating it from big-endian to little-endian for x86_64 arch.

Which way is correct?

I would like to check this fact in wireshark's source code and maybe fix it, but I don't have enough free time to read developers manual.

Could anybody please answer, where to find RTP-header parser source code in wireshark's sources ?

How to report about this MAY BE bug?

asked 03 Jun '15, 10:13

yucacodec's gravatar image

yucacodec
6113
accept rate: 0%


Your picture shows that Wireshark is decoding the field in big endian (network order): 1c6b89db in hexadecimal is equal to 476809691 in decimal. So there is nothing to fix here (what you see in the byte panel is what is transmitted over the wire, and does not represent the memory of your little endian machine).

permanent link

answered 03 Jun '15, 12:42

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

yes, that's right. Thanks.

(04 Jun '15, 01:59) yucacodec

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(04 Jun '15, 02:17) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×13
×11

question asked: 03 Jun '15, 10:13

question was seen: 2,540 times

last updated: 04 Jun '15, 02:17

p​o​w​e​r​e​d by O​S​Q​A