Ethereal-dev: [Ethereal-dev] FW: [Ethereal-users] Ethereal hangs when doing RTP Stream Analysi

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Francisco Alcoba (TS/EEM)" <francisco.alcoba@xxxxxxxxxxxx>
Date: Wed, 1 Dec 2004 19:11:04 +0100 
>The attached file contains 4 packets extracted from a real network capture of a modem connection >over RTP.  When I load it into Ethereal, ask to decode it as RTP, and then select  Statistics - >Rtp - Steam Analysis in the menus, Ethereal hangs.  I upgraded to the latest on the web site 
>(0.10.7) and still no luck.  In running Ethereal on Win XP SP2.  Anyone know what's going wrong? 

Hi,

This seems to come from two RTP packets that have inverted timestamps, with the second having the marker bit set; i.e., the second packet has a timestamp that is lower than the second. In this 
case it also happens that the second packet's sequence number is higher than the first, which is
strange, but I think this might happen also with plain packet reordering. 

The problem is around line 882 of rtp_analysis.c, where there is a loop of silence saving that 
lasts strinfo->delta_timestamp, which is equal to the timestamp difference, which is huge in this
situation, since it is calculated as a difference between the two timestamps around line 657. 
Since we are writing to a temporal file, an additional consequence is that this file grows very 
fast -200 Mb in the time it took me to kill ethereal- and gets stale in the temp directory.

I've added a check for the inverted timestamps and a new error code. However, it does not show
in this trace because it also has a payload change, that takes precedence. Ethereal does not
hang anymore, but I am not sure the patch is as should be.

Regards,
  Francisco

Attachment: hang.cap
Description: Binary data

Attachment: rtp_analysis.patch
Description: Binary data