This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to bind both RTP streams of a VoIP communication (MGCP/SDP)

0

I have several Pcaps, some of them with only one communication (2 RTP streams), some of them with several communications (several streams).

I'm trying to figure how can I bind RTP stream A and B of each communications.

I've found in SDP packets the field mgcp.param.connectionid (2 bytes) that GENERALLY can help me for that, but in some pcaps one of the SDP has not this field.

I've also found a couple of pcaps with 3 RTP streams with the same connectionid field (one forward and two reverse)

I've also found a way in tshark with this command line to bind both ssrc

tshark -n -r xxxxxxx.pcap -2 -R rtcp -T fields -e rtcp.ssrc.identifier -Eseparator=, | sort -u | awk -F, {'print $1, $2'} | sort -u

but I can't reproduce the same in pyshark, rtcp.ssrc.identifier field does'nt have the list of ssrc. I'm not even sure that each stream HAS at least one RTCP packet for taking this approach.

asked 17 Sep '15, 07:59

qsebas's gravatar image

qsebas
31223
accept rate: 100%