This is our old Q&A Site. Please post any new questions and answers at

I have several Pcaps, some of them with only one communication (2 RTP streams), some of them with several communications (several streams).

I'm trying to figure how can I bind RTP stream A and B of each communications.

I've found in SDP packets the field mgcp.param.connectionid (2 bytes) that GENERALLY can help me for that, but in some pcaps one of the SDP has not this field.

I've also found a couple of pcaps with 3 RTP streams with the same connectionid field (one forward and two reverse)

I've also found a way in tshark with this command line to bind both ssrc

tshark -n -r xxxxxxx.pcap -2 -R rtcp -T fields -e rtcp.ssrc.identifier -Eseparator=, | sort -u | awk -F, {'print $1, $2'} | sort -u

but I can't reproduce the same in pyshark, rtcp.ssrc.identifier field does'nt have the list of ssrc. I'm not even sure that each stream HAS at least one RTCP packet for taking this approach.

asked 17 Sep '15, 07:59

qsebas's gravatar image

accept rate: 100%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 17 Sep '15, 07:59

question was seen: 1,832 times

last updated: 17 Sep '15, 07:59

p​o​w​e​r​e​d by O​S​Q​A