How to see whether the pcap contains RTP traffic?

Question

I am analyzing the traffic of a VOIP application. I started up wireshark, and made sure no other application was using internet, and then had a a voice call on the application. Wireshark captured some nice UDP packets for me. I did that three times for voice and three times for video. Now I want to analyze the traffic, that is, find out what kind of traffic is there, or whether there are any application specific patterns etc.

I did read up on google to right click on a packet and select decode as -> RTP - but then I don't see any RTP header or payload, all I see is Version: Version draft 1 in under the RTP heading.

Any help or guidance in this regard is appreciated.

BTW - I am reading RFCs and what now, but still can't figure out how to analyse traffic and figure out whether RTP is there or not, and if it is, whether the media is transferred using just this, or something else too?

Answer 1

Some Issues to consider

• Are you sure that you captured all the traffic on the network interface ?
• Are you running the latest version of Wireshark ?
• Are you sure you didn't try to decode SIP traffic as RTP traffic ?

My advice would be to download some pcaps that contain known RTP traffic from Pcapr ie the following PCAP SIP PCAP . Once your more comfortable with what RTP traffic should look like, you will have a better chance of spotting it on your own network.

• note I have no connection with pcapr

Answer 2

The easiest way to see if the pcap contains RTP is if there is an exchange in the control protocol that sets up the session. E.g. in SIP an INVITE and associated messages, in MGCP a CRCX message, etc. If you've recorded the entire conversation, wireshark will normally decode the RTP automatically.

If the app is using a nonstandard/proprietary control protocol, you can guess at the presence of RTP if the packets by (a) checking that the header lines up with the RTP packet format and (b) (in many cases) looking for the presence of RTCP on the next-higher odd UDP port number (e.g. if RTP is on 32020, then RTCP would be on 32021).

In your case, wireshark is telling you that the "RTP" you're decoding is Version 1. RFC 3550 says:

  version (V): 2 bits
    This field identifies the version of RTP.  The version defined by
    this specification is two (2).  (The value 1 is used by the first
    draft version of RTP and the value 0 is used by the protocol
    initially implemented in the "vat" audio tool.)

So it's highly unlikely that what you're seeing is RTP.