I have several Pcaps, some of them with only one communication (2 RTP streams), some of them with several communications (several streams). I'm trying to figure how can I bind RTP stream A and B of each communications. I've found in SDP packets the field mgcp.param.connectionid (2 bytes) that GENERALLY can help me for that, but in some pcaps one of the SDP has not this field. I've also found a couple of pcaps with 3 RTP streams with the same connectionid field (one forward and two reverse) I've also found a way in tshark with this command line to bind both ssrc tshark -n -r xxxxxxx.pcap -2 -R rtcp -T fields -e rtcp.ssrc.identifier -Eseparator=, | sort -u | awk -F, {'print $1, $2'} | sort -u but I can't reproduce the same in pyshark, rtcp.ssrc.identifier field does'nt have the list of ssrc. I'm not even sure that each stream HAS at least one RTCP packet for taking this approach. asked 17 Sep '15, 07:59 qsebas |