How does wireshark determine out of sequence for rtp packets. I have a capture that shows the first 5 packets coming from one voip device as "out of sequence" but the rest are good - it's repeating the first 5 packets (i.e. 0, 1, 2, 3, 0, 1 etc). Coming from the other voip device all packets are in correct sequence. When we look at it through the player, it shows 99.9% of the rtp packets are out of sequence from both devices. It also will not play back. Is this a Wireshark bug? When you listen to the actual audio from the device, it sounds chopy. Thanks asked 02 Jul '15, 18:35  EricKnaus |
One Answer:
The RFC is very clear about how sources must count their packets, unfortunately in real life many implementations screw this up, leaving the endpoints to fend for themselves. Wireshark tries to be as true to the source as possible, in that it should represent what the source sends out, vs. what an advanced, possibly DSP equipped, endpoint can restore from it. As for this specific case it looks like the one device is in error, but without looking at the capture file it's hard to tell why this interferes with the other stream. If you can share the capture file this would allow for a more thorough analysis. And: what wireshark version are you using? answered 03 Jul '15, 07:35  Jaap ♦ |
