Wireshark · Ethereal-dev: Re: [Ethereal-dev] RTP Analysis: How to get raw RTP packet offset and size

[Miha Jemec <m.jemec@xxxxxxxxxxx>]

Hi!
> 
> what exactly are
> struct _rtp_info {
>     ...
>     guint  info_data_len;
>     guint  info_payload_offset;
>     guint  info_payload_len;
> };
> 
> in packet-rtp.c, info_data_len is defined as
>  rtp_info.info_data_len = tvb_reported_length_remaining( tvb, offset );

info_data_len - this is the length of rtp field (rtp header + rtp
payload (data + padding) )

info_payload_len - length of rtp payload (raw "voice" + rtp padding)

info_payload_offset - length of rtp header

I attached 5 rtp samples (see rtp.raw):

1) "normal" rtp G.711, 30 ms packet, legth 294 bytes
info_data_len = 252
info_payload_offset = 240
info_payload_offset = 12

2) normal + 1x CSRC field (+4 bytes), length 298 bytes
info_data_len = 256
info_payload_offset = 240
info_payload_offset = 16

3) normal + 4 RTP padding bytes, length 298 bytes
info_data_len = 256
info_payload_offset = 244
info_payload_offset = 12

4) normal + extension (length of extension = 1,  this adds 8 bytes),
length total 302 bytes
info_data_len = 260
info_payload_offset = 240
info_payload_offset = 20

5) normal + 2x CSRC field (+8 bytes) + extension (length = 2, this adds
12 bytes) + 4 padding bytes, total length 318 bytes
info_data_len = 276
info_payload_offset = 244
info_payload_offset = 32

Since you always get number of padding bytes as well, it is possible to
determine the beginning and length of RTP payload (raw "voice&video"
data). Of course you need a pointer that points to the beginning of rtp
field.

Regards, Miha


 
Miha Jemec <m.jemec@xxxxxxxxxxx>

Attachment: rtp.raw
Description: Binary data