This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have several Pcaps, some of them with only one communication (2 RTP streams), some of them with several communications (several streams).

I'm trying to figure how can I bind RTP stream A and B of each communications.

I've found in SDP packets the field mgcp.param.connectionid (2 bytes) that GENERALLY can help me for that, but in some pcaps one of the SDP has not this field.

I've also found a couple of pcaps with 3 RTP streams with the same connectionid field (one forward and two reverse)

I've also found a way in tshark with this command line to bind both ssrc

tshark -n -r xxxxxxx.pcap -2 -R rtcp -T fields -e rtcp.ssrc.identifier -Eseparator=, | sort -u | awk -F, {'print $1, $2'} | sort -u

but I can't reproduce the same in pyshark, rtcp.ssrc.identifier field does'nt have the list of ssrc. I'm not even sure that each stream HAS at least one RTCP packet for taking this approach.

asked 17 Sep '15, 07:59

qsebas's gravatar image

qsebas
31223
accept rate: 100%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×139
×5

question asked: 17 Sep '15, 07:59

question was seen: 1,668 times

last updated: 17 Sep '15, 07:59

p​o​w​e​r​e​d by O​S​Q​A