Wireshark · Ethereal-dev: Re: [Ethereal-dev] RTP audio listener

["Martin Regner" <martin.regner@xxxxxxxxx>]

Ronnie Sahlberg wrote:
<What about adding something more generic    such as a
<tap that will  open a file (fopen())or a pipe (popen())
<and write, in pcap format, all the packets that match a certain filter to it?

<Then your application would just be :
<a tipe that writes the packets to some pipe ( | rtpdump .... ) and
<hand off everything else to some external application.

I have been thinking of adding a possibility to save all RTP streams (or one or more selected RTP-streams) in
rtpdump format from the RTP-analysis. The approach I was thinking of was to write one rtpdump file for each
of the streams and then also write some kind of summary-file (maybe in xml-format) that will contain some data about
each stream
that could be useful for the post-analysis program(s).

The advantage with using the rtpdump format (or similar format) instead of dumping the complete packets including
lower layer protocols is that the applications doing the post-analysis doesn't have to understand different lower
layers.

I already have some program that I have made that can extract all RTP-streams from a capture file, but it only
works if RTP-packets are sent directly over Ethernet/IP/UDP and a few more variants (e.g. with VLAN headers).
Ethereal is very good on handling on different protocols, so it is better that Ethereal takes care of handling the
different lower layers, I think.