9.11. RTP
Prev | Chapter 9. Telephony | Next

## 9.11. RTP

### 9.11.1. RTP Streams Window

The RTP streams window shows all RTP streams in capture file. Streams can be selected there and on selected streams other tools can be initiated.

Figure 9.8. The “RTP Streams” window

User can use shortcuts:

- Selection

  - Ctrl+A - Select all streams
  - Ctrl+I - Invert selection
  - Ctrl+Shift+A - Select none
  - Note: Common Mouse click, Shift+Mouse click and Ctrl+Mouse click works too

- Find Reverse

  - R - Try search for reverse streams related to already selected streams. If found, selects them in the list too.
  - Shift+R - Select all pair streams (forward/reverse relation).
  - Ctrl+R - Select all single streams (no reverse stream does exist).
- G - Go to packet of stream under the mouse cursor.
- M - Mark all packets of selected streams.
- P - Prepare filter matching selected streams and apply it.
- E - Export selected streams in RTPDump format.
- A - Open RTP Stream Analysis window and add selected streams to it.

Available controls are:

- Find Reverse

  - Find Reverse search for reverse stream of every selected stream. If found, selects it in the list too.
  - Find All Pairs select all streams which have forward/reverse relation.
  - Find Only Single select all streams which are single - have no reverse stream.
- Analyze opens RTP Stream Analysis window. Actions Set, Add and Remove are available.
- Prepare Filter prepares filter matching selected streams and apply it.
- Play Streams opens RTP Player window. Actions Set, Add and Remove are available.
- Copy copies information from table to clipboard in CSV or YAML.
- Export exports selected streams in RTPDump format.

### 9.11.2. RTP Stream Analysis Window

The RTP analysis function takes the selected RTP streams and generates a list of statistics on them including a graph.

The Telephony → RTP → RTP Stream Analysis menu item is enabled only when the selected packet is an RTP packet. When the action is selected, the RTP Stream Analysis window is opened (if not already) and the RTP stream of the current packet is added for analysis. If Ctrl is pressed when selecting the menu item, other RTP streams on the same addresses and ports (in both forward and reverse direction) are scanned for and added to the window too if found.

Every stream is shown on its own tab. Tabs are numbered as streams are added and each tooltip shows the identification of the stream. When a tab is closed, its number is not reused. The tab color matches the color of the corresponding graph on the graph tab.

Figure 9.9. The “RTP Stream Analysis” window

Figure 9.10. Error indicated in “RTP Stream Analysis” window

Per packet statistic shows:

- Packet number
- Sequence number
- Delta (ms) to last packet
- Jitter (ms)
- Skew
- Bandwidth
- Marker - packet is marked in RTP header
- Status - information related to the packet. E. g. change of codec, DTMF number, warning about incorrect sequence number.

Side panel left to packet list shows stream statistics:

- Maximal delta and at which packet it occurred
- Maximal jitter
- Mean jitter
- Maximal skew
- Count of packets
- Count of lost packets - calculated from sequence numbers
- When the stream starts and first packet number
- Duration of the stream
- Clock drift
- Frequency drift

| Note
Some statistic columns are calculated only when Wireshark is able to decode codec of RTP stream.

Available shortcuts are:

- G - Go to selected packet of stream in packet list
- N - Move to next problem packet

Available controls are:

- Prepare Filter

  - Current Tab prepares filter matching current tab and applies it.
  - All Tabs prepares filter matching all tabs and applies it.
- Play Streams opens RTP Player window. Actions Set, Add and Remove are available.
- Export allows export current stream or all streams as CSV or export graph as image in multiple different formats (PDF, PNG, BMP and JPEG).

Figure 9.11. Graph in “RTP Stream Analysis” window

Graph view shows graph of:

- jitter
- difference - absolute value of difference between expected and real time of packet arrival
- delta - time difference from reception of previous packet

for every stream. Checkboxes below graph are enabling or disabling showing of a graph for every stream. Stream X checkbox enables or disables all graphs for the stream.

| Note
Stream Analysis window contained tool for save audio and payload for analyzed streams. This tool was moved in Wireshark 3.5.0 to RTP Player window. New tool has more features.

### 9.11.3. RTP Player Window

The RTP Player function is a tool for playing VoIP calls. It shows RTP streams and their waveforms, and can play the streams and export them to file as audio or raw payload. See related concepts in Section 9.2, “Playing VoIP Calls”.

The Telephony → RTP → RTP Player menu item is enabled only when the selected packet is an RTP packet. When the action is selected, the RTP Player window is opened (if not already) and the RTP stream of the current packet is added to the playlist. If Ctrl is pressed when selecting the menu item, other RTP streams on the same addresses and ports (in both forward and reverse direction) are scanned for and added to the playlist too if found.

Figure 9.12. RTP Player window

RTP Player Window consists of three parts:

1. Waveform view
2. Playlist
3. Controls

Waveform view shows visual presentation of RTP stream. Color of waveform and playlist row are matching. Height of wave shows volume.

Waveform shows error marks for Out of Sequence, Jitter Drops, Wrong Timestamps and Inserted Silence marks if it happens in a stream.

Figure 9.13. Waveform with error marks

Playlist shows information about every stream:

- Play - Audio routing
- Source Address, Source Port, Destination Address, Destination Port, SSRC

- Setup Frame

  - SETUP <number> is shown, when there is known signaling packet. Number is packet number of signaling packet. Note: Word SETUP is shown even RTP stream was initiated e. g. by SKINNY where no SETUP message exists.
  - RTP <number> is shown, when no related signaling was found. Number is packet number of first packet of the stream.
- Packets - Count of packets in the stream.
- Time Span - Start - Stop (Duration) of the stream
- SR - Sample rate of used codec
- PR - Decoded play rate used for stream playing
- Payloads - One or more payload types used by the stream

| Note
When rtp_udp is active, most of streams shows just RTP <number> even there is setup frame in capture. When RTP stream contains multiple codecs, SR and PR are based on first observed coded. Later codecs in stream are resampled to first one.

Controls allow a user to:

- Start/Pause/Stop playing of unmuted streams

- >> enabling/disabling silence skipping

  - Min silence - Minimal duration of silence to skip in seconds. Shorter silence is played as it is.
- Select Output audio device and Output audio rate

- Select Playback Timing

  - Jitter Buffer - Packets outside Jitter Buffer size are discarded during decoding
  - RTP Timestamp - Packets are ordered and played by its Timestamp, no Jitter Buffer is used
  - Uninterrupted Mode - All gaps (e. g. Comfort Noise, lost packets) are discarded therefore audio is shorter than timespan
- Time of Day selects whether waveform timescale is shown in seconds from start of capture or in absolute time of received packets
- Refresh streams refreshes streams during live capture (see Section 9.2.3, “Playing audio during live capture”). Button is disabled when no live capture is running.

- Inaudible streams

  - Select select all inaudible streams (streams with zero play rate)
  - Deselect deselect all inaudible streams (streams with zero play rate)
- Analyze open RTP Stream Analysis window. Actions Set, Add and Remove are available.
- Prepare Filter prepare filter matching selected streams and apply it.
- Export - See Section 9.11.3.1, “Export”.

| Note
RTP Player detects silence just by missing voice samples (Comfort Noise, interrupted RTP, missing RTP, …​) or when some streams are muted.

Figure 9.14. RTP stream state indication

Waveform view and playlist shows state of a RTP stream:

1. stream is muted (dashed waveform, Muted is shown in Play column) or unmuted (non-dashed waveform, audio routing is shown in Play column)
2. stream is selected (blue waveform, blue row)
3. stream is below mouse cursor (bold waveform, bold font)

User can control to where audio of a stream is routed to:

- L - Left channel
- L+R - Left and Right (Middle) channel
- R - Right channel
- P - Play (when mono soundcard is available only)
- M - Muted

Audio routing can be changed by double-clicking on first column of a row, by shortcut or by menu.

User can use shortcuts:

- Selection

  - Ctrl+A - Select all streams
  - Ctrl+I - Invert selection
  - Ctrl+Shift+A - Select none
  - Note: Common Mouse click, Shift+Mouse click and Ctrl+Mouse click works too

- Go to packet

  - G - Go to packet of stream under the mouse cursor
  - Shift+G - Go to setup packet of stream under the mouse cursor

- Audio routing

  - M - Mute all selected streams
  - Shift+M - Unmute all selected streams
  - Ctrl+M - Invert muting of all selected streams
- P - Play audio
- S - Stop playing
- Del or Ctrl+X - Remove all selected streams from playlist

- Inaudible streams

  - N - Select all inaudible streams
  - Shift+N - Deselect all inaudible streams

#### 9.11.3.1. Export

| Note
Export was moved from RTP Stream Analysis window to RTP Player window in 3.5.0. Wireshark is able to export decoded audio in .au or .wav file format. Prior to version 3.2.0, Wireshark only supported exporting audio using the G.711 codec. From 3.2.0 it supports audio export using any codec with 8000 Hz sampling. From 3.5.0 is supported export of any codec, rate is defined by Output Audio Rate.

Export options available:

- for one or more selected non-muted streams

  - From cursor - Streams are saved from play start cursor. If some streams are shorter, they are removed from the list before save and count of saved streams is lower than count of selected streams.
  - Stream Synchronized Audio - File starts at the begin of earliest stream in export, therefore there is no silence at beginning of exported file.
  - File Synchronized Audio - Streams starts at beginning of file, therefore silence can be at start of file.

- for just one selected stream

  - Payload - just payload with no information about coded is stored in the file

Audio is exported as multi-channel file - one channel per RTP stream. One or two channels are equal to mono or stereo, but Wireshark can export e.g., 100 channels. For playing a tool with multi-channel support must be used (e.g., https://www.audacityteam.org/).

Export of payload function is useful for codecs not supported by Wireshark.

| Note
Default value of Output Audio Rate is Automatic. When multiple codecs with different codec rates are captured, Wireshark decodes each stream with its own play audio rate. Therefore, each stream can have a different audio rate. If you attempt to export audio when there are multiple audio rates, it will fail because .au or .wav require a fixed audio rate. In this case user must manually select one of rates in Output Audio Rate, streams will be resampled and audio export succeeds.

Prev | Up | Next
9.10. Osmux Windows | Home | 9.12. RTSP Window