Wireshark · Wireshark-users: [Wireshark-users] VoIP call analysis / number of expected RTP packet wrong calculation

["Stephane Cohen (stcohen)" <stcohen@xxxxxxxxx>]

Hi

 

Using Wireshark 1.0.1

 

From Statistics -> RTP -> Stream analysis, you get a report including the number of packet lost, which is calculated against the number of *expected* packets.

 

From  http://www.ethereal.com/lists/ethereal-dev/200305/msg00106.html I see this is calculated that way

 

guint32 f_expected = (rs->f_stop_seq_nr + rs->f_cycles*65536) - rs->f_start_seq_nr + 1;

That is "last packet seq number" - "first packet seq number" corrected w the number of times you wrap the max int value 65536. This seems fine however we have a few captures where wireshark miscalculates the expected number of RTP packets b/c it wrongly adds a "cycle". I think this is triggered by the fact some packets are received out of sequence (due to high jitter) but I'm not positive.

Have you seen this before? I can provide the capture unicast if needed.

Thanks in advance,

Stephane.