This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

RTP streams with the same SSRC field

0

I'm trying to test a network by sending calls directly between two SIPp instances. However when I try to analyze the stream with wireshark it cannot understand the RTP. It only show a stream in one direction, which has the count of all packets in both directions.

I have a suspicion that the problem lies in the SSRC value which is the same in both directions.

10    2015-12-15 15:35:02.090403    194.247.61.193 194.247.61.197
RTP    214    PT=ITU-T G.711 PCMA, SSRC=0xC1A0112, Seq=0, Time=0, Mark
11    2015-12-15 15:35:02.094980    194.247.61.197 194.247.61.193
RTP    214    PT=ITU-T G.711 PCMA, SSRC=0xC1A0112, Seq=0, Time=0, Mark

It is not easy to change the SSRC value in the test. So before I go and recompile something, I would like to hear if this is really a problem to Wireshark, or if I should look else where.

asked 15 Dec '15, 13:53

Kjeld%20Flarup's gravatar image

Kjeld Flarup
6●4●4●8
accept rate: 0%

edited 15 Dec '15, 13:56

Please post the pcap file, containing at least 10 RTP packets in each direction and at least the part of SIP message exchange which contains the SDP negotiation, somewhere on the web (google drive, skydrive, cloudshark...) and put a link to it here. Without having a look at the file it is hard to say what is wrong. Wireshark's automatic detection of RTP streams is bound to SDP, and analysis of RTP depends also on timestamps and sequence numbers (if at all on ssrc which I doubt but I'm not a Wireshark developer).

(15 Dec '15, 14:01) sindy

One Answer:

0

After checking the pcap received directly from Kjeld, I'm answering here for others: in Wireshark 2.0.0, the same SSRC in both directions of RTP stream does cause confusion, but only if dealing with RTP via Telephony -> VoIP calls -> Flow Sequence. If dealing with it via RTP -> Stream analysis, the directions are not mixed together and RTP stream analysis as well as playback work as expected. I'll file the bug.

answered 17 Dec '15, 12:10

sindy's gravatar image

sindy
6.0k●4●8●51
accept rate: 24%