Ethereal-dev: RE: [Ethereal-dev] Re: [Ethereal-users] How to make ethereal reco gnise RTP,RTCP
You can't count on the RTP odd port RTCP even port as part of a
heuristic. There are a LOT of RTP implementations that have decided
that RTCP isn't really necessary ( I happen to believe this means their
broken, but it gets done a lot ). Also I seem to recall discussion
floating around about allowing the specification of port for RTCP
which are not the next port after the RTP traffic.
This Terayon Highlink router... are you sure it is recognizing the
RTP via a heuristic and not just watching the signalling traffic ( H323,
MGCP, SIP, RTSP etc ) to determine where to look?
Ed
On Thu, 2002-06-27 at 03:30, Feyaerts Johan wrote:
>
>
> I think the RFC also say somewhere that RTP runs on an even and RTCP on an
> odd port number one higher than the RTP stream. (most implementations follow
> this standard)
> Checking sequence numbers that increase may also help but you'd have to look
> at more than 1 packet then.
>
>
> It is possible to detect RTP/RTCP by means of heurisics. The Terayon
> Highlink router (former radwiz) does it via some proprietary algorithm in
> real time. So I think it should be possible to do a similar thing offline
> in ethereal.
> > -----Original Message-----
> > From: andreas.sikkema@xxxxxxxxxxx [mailto:andreas.sikkema@xxxxxxxxxxx]
> > Sent: donderdag 27 juni 2002 9:23
> > To: ethereal-dev@xxxxxxxxxxxx
> > Subject: [Ethereal-dev] Re: [Ethereal-users] How to make ethereal
> > recognise RTP,RTCP,SCTP over UDP
> >
> >
> > > RTP and RTCP don't have standard port numbers, and nobody's
> > figured out
> > > any heuristic to guess whether a UDP packet is an RTP or
> > RTCP packet or
> > > not;
> >
> > Hmm, I was just thinking,
> > - Check if the version is in the correct range (0-3 or something)
> > - Check if the length of the received UDP data is the same as the
> > length the RTP/RTCP message says it is
> > - For RTP you could also check if the mediatype is in the
> > correct range.
> > - For RTCP you could check if walking the SSRC parts ends up
> > at the end
> > of the message (or at the start of padding)
> > - Check if the padding stuff also matches? This one I'm not
> > sure about.
> >
> > This is all from the head, no RFC on hand at the moment, so....
> >
> > But I don't have enough experience with heuristics to be able
> > to predict
> > how precise this is.
> >
> > --
> > Andreas Sikkema
> > andreas.sikkema@xxxxxxxxxxx
> > "While you're waiting, read the free novel we sent you.
> > It's a Spanish story about a guy named `Manual'" - Dilbert
> >
> >
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
Attachment:
signature.asc
Description: This is a digitally signed message part
