This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

My task is to perform an experiment with RTP packets delays measurement (the traffic is simply streaming music from my server to my PC).

I've read a related question (Measure packet delay RTP) and figured out that it's not really possible if I capture the traffic only on my PC, because Wireshark can't calculate delay in such case. So, obviously, I have to capture traffic also on the server-side. It's OK, I can run tshark there for capturing.

My question is: what should I do after? How do I merge two captures (local and remote) and how do I pass them to Wireshark to let it calculate delays for me? If I simply merge two pcap's to one file and load it to Wireshark, will it understand that it's the same RTP session captured from two machines and will it be able to calculate packets delays for me?

asked 13 Nov '16, 08:02

trixter's gravatar image

trixter
21459
accept rate: 0%

edited 13 Nov '16, 08:03


The simple answer would be "open one of the files, then go to File->Merge, choose Merge packets chronologically, select the other file and press Open. Then you would just compare the differences of timestamps of pairs of RTP packets bearing the same RTP sequence number.

However, you need that the real time clock of your server and your PC are well synchronized, as eventual difference of the two machines' real time clock will skew the result. If everything is on a single LAN, the relative significance of the clock difference may be really high.

permanent link

answered 13 Nov '16, 10:43

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 14 Nov '16, 10:21

"Then you would just compare the differences of timestamps of pairs of RTP packets bearing the same RTP sequence number." Can Wireshark do it automatically or I should write some script to achieve it?

(13 Nov '16, 11:20) trixter

There is nothing like that embedded in Wireshark.

If I were to do that, I'd use the good ol' Excel - I'd export packets with the same ssrc from both captures, not merging them together, into csv files, like this:

tshark -r your\file\name.pcapng -Y "rtp.ssrc == 0xyourssrc" -T fields -e rtp.seq -e frame.time_epoch > your\file\name.csv

I would then import these files to Excel (with space as separator), use the first columns of both (the rtp.seq values) to properly match the pairs of timestamps and notice eventual lost packets, and let Excel calculate the average of differences between the second columns, leaving out lost packets from the calculation.

(14 Nov '16, 10:20) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×43

question asked: 13 Nov '16, 08:02

question was seen: 1,540 times

last updated: 14 Nov '16, 10:21

p​o​w​e​r​e​d by O​S​Q​A