decoding timestamp in rtp header

Question

Hello, I'm running wireshark on debian Wheezy on x86_64 machine. I've found that when wireshark is decoding UDP as RTP packets, it's decoding timestamp in RTP header incorrectly according to RFC3550 page 12:

4. Byte Order, Alignment, and Time Format All integer fields are carried in network byte order, that is, most significant byte (octet) first. This byte order is commonly known as big-endian.

and page 76:

    /*
    * RTP data header
    */
   typedef struct {
       unsigned int version:2;   /* protocol version */
       unsigned int p:1;         /* padding flag */
       unsigned int x:1;         /* header extension flag */
       unsigned int cc:4;        /* CSRC count */
       unsigned int m:1;         /* marker bit */
       unsigned int pt:7;        /* payload type */
       unsigned int seq:16;      /* sequence number */
       u_int32 ts;               /* timestamp */
       u_int32 ssrc;             /* synchronization source */
       u_int32 csrc[1];          /* optional CSRC list */
   } rtp_hdr_t;

As you can see on the screenshot, wireshark decodes timestamp "as is", without translating it from big-endian to little-endian for x86_64 arch.

Which way is correct?

I would like to check this fact in wireshark's source code and maybe fix it, but I don't have enough free time to read developers manual.

Could anybody please answer, where to find RTP-header parser source code in wireshark's sources ?

How to report about this MAY BE bug?

Answer 1

Your picture shows that Wireshark is decoding the field in big endian (network order): 1c6b89db in hexadecimal is equal to 476809691 in decimal. So there is nothing to fix here (what you see in the byte panel is what is transmitted over the wire, and does not represent the memory of your little endian machine).