Wireshark · Wireshark-users: Re: [Wireshark-users] Filtering AMR rates in RTP

["Anders Broman" <anders.broman@xxxxxxxxxxxx>]

Hi,

It looks like for the  “bandwidth efficient mode” fileters are not implemented:

 

:

/* Check F bit */

bitcount += 1;

frame_following = tvb_get_guint8(tvb,bitcount/8) & 0x80 >> (bitcount % 8);

unit16val = tvb_get_ntohs(tvb,bitcount/8);

ft = (unit16val >> (11 - (bitcount % 8))) &0x000F;

if (amr_mode==AMR_NB)

item = proto_tree_add_text(tree, tvb, bitcount/8, 1+(bitcount % 8)/5,

"%s", amr_nb_codec_mode_request_vals[ft].strptr);

else

item = proto_tree_add_text(tree, tvb, bitcount/8, 1+(bitcount % 8)/5,

"%s", amr_wb_codec_mode_request_vals[ft].strptr);

bitcount += 4;

:

You could raise a bug report with a enhancement request attaching a small sample trace.

Reagrds

Anders

---

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Andreas Byström (Polystar T & M)
Sent: den 19 december 2008 11:45
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] Filtering AMR rates in RTP

Hi,

 

I’m trying to filter a trace of an AMR rtp stream. The AMR (narrowband, nb) is coded in “bandwidth efficient mode” and I’m guessing that’s why I don’t get my filter to work.

I want to filter on the “frame type index” and found the following filter that I thought would work:

amr.nb.toc.ft == 5  (where 5 is the rate 7,95)

 

However, applying this filter on my trace gives an empty result. If I display the whole trace I see that there are several ARM packets with this frame type index.

 

Anyone have an idea on what filter I should try instead or if I have done something wrong? I’m not sure if I’m allowed (or should) send attachements to this mailing list, but I have a trace that I can post if someone is interested in trying different filters on my capture file. Let me know if I should do this

 

Regards,

// Andreas