Wireshark · Wireshark-users: Re: [Wireshark-users] Fwd: sequence number and packet id

[Guy Harris <guy@xxxxxxxxxxxx>]

Fabiana moreno wrote:
> im trying to calculate the end to end delay....

What are the "ends" in "end to end"?  Do you mean the delay between the 
time at which the packet is sent from the host that's sending it to the 
time at which the packet is received by the host that's receiving it?

If so, that's what the RTP sequence number is used for.

> if i have the id i can 
> determine what packet is missing

If you have the RTP sequence number, you can determine what packets 
aren't in the capture (which could just mean that they weren't captured; 
it doesn't necessarily mean they weren't sent or weren't received) - to 
quote RFC 1889:

	sequence number: 16 bits
	     The sequence number increments by one for each RTP data packet 
sent, *and may be used by the receiver to detect packet loss* and to 
restore packet sequence. The initial value of the sequence number is
random (unpredictable) to make known-plaintext attacks on encryption
more difficult, even if the source itself does not encrypt, because the
packets may flow through a translator that does. Techniques for choosing
unpredictable numbers are discussed in [7].