Right. I should have said "for example, using G.711 with 20MS packetization
with 160 byte payloads will be 214 bytes on the wire". If you know what to
expect, you can customize your capture filter or display filters. I use
display filters all the time and just save what is displayed to create a
file of just those RTP or signaling packets. This still does not get around
having Ethereal automatically detect and decode RTP packets. Decode as
works just fine.
Sniffer Basic and Sniffer Pro do detect and decode RTP automatically. But at
a substantial cost. Ethereal is much more flexible and easier to use.
Plus, the support from folks like Guy is unmatched.
Joe
-----Original Message-----
From: Motonori Shindo [mailto:mshindo@xxxxxxxxxxx]
Sent: Wednesday, May 15, 2002 8:49 AM
To: Joe.Aiello@xxxxxxxxxxxx
Cc: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Voip sniffing
Joe,
From: "Joe Aiello" <Joe.Aiello@xxxxxxxxxxxx>
Subject: RE: [Ethereal-users] Voip sniffing
Date: Tue, 14 May 2002 20:59:11 -0700
> If you want to capture just the RTP stream(s), if you could creat a
capture
> filter to capture only UDP packets that are 214 bytes, that will get G.711
> packets.
Not necessarily. Unlike the codec like G.729 and G.723, G.711 doesn't
define a frame size, so it's up to the implementation as to how long
G.711 encoded voice will form a single RTP packet.
Regards,
=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
+----+----+
|.. .| | Motonori Shindo
|_~__| |
| .. |~~_~| Sr. Systems Engineer
| . | | CoSine Communications Inc.
+----+----+
C o S i n e e-mail: mshindo@xxxxxxxxxxxxx
Communications
=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
