Hello, i am trying to play RTP stream on wireshark but having trouble. I load the file in wireshark (.pcap file with udp packets) Telephony > VOIP calls > seperate window pops up to recalculate statistics but nothing to select here. please guide.. asked 19 Oct '15, 10:51  jigrami edited 19 Oct '15, 10:53 |
2 Answers:
On the one hand you talk about RTP streams, but then you say that the VoIP calls dialog doesn't show anything. Even though they are related it's not a given that just about any RTP stream shows up in there. Or rather, non at all will show up. Only VoIP call signalling packets will lead to entries in the VoIP calls dialog. From there, and only if the media negotiation information can be dissected, are RTP streams identified and can be feed to the player. So, since you obviously have no VoIP call signalling packets there is another way to go about it. First of all you'll need to go into the RTP dissector preferences and tick the option 'Try to decode RTP outside of conversations'. This will dissect eligable UDP packets as RTP packets. Now go into the menu item Telephony -> RTP -> Show All Streams. This will give you a dialog to select a stream, analyse it and subsequently play it. answered 19 Oct '15, 13:10  Jaap ♦ |
Can you upload the packetcapture? you can use https://www.cloudshark.org/ My suggestion is to filter the stream and only then decode/play the .wav file. More information here - https://wiki.wireshark.org/VoIP_calls answered 24 Oct '15, 12:51  Boaz Galil edited 24 Oct '15, 12:51 |
hello, thanks Jaap. here is what's going on. The file I have captured is from our VM environment to a local PC. I loaded the file in wireshark under info column it shows source port PCoIP (pc over ip).
And other tool I use it CA/NetQoS-Observer, which shows these packets as RTP Payload: PCMU (G.711)Audio at 8000Hz
These UDP packets may not be VOIP calls; but its streaming from the VM machine to a local machine and I am trying to see that...
Thank You
I don't follow. Can you share the capture file?