How to correlate output of tshark rtp.heuristic_rtp:TRUE with dialed phone numbers
I'm running VoIP server and use tshark to monitor RTP streams quality
I use something like this command:
> tshark -q -f 'udp portrange 16384-32768' -o rtp.heuristic_rtp:TRUE -z rtp,streams
And get nice output with RTP stats per client IP address:
> ========================= RTP Streams ========================
> Src IP addr Port Dest IP addr Port SSRC Payload Pkts
> Lost Max Delta(ms) Max Jitter(ms)
> Mean Jitter(ms) Problems?
> 27.17.59.11 5291 274.159.19.28 20174 0x50C709D4 ITU-T G.711 PCMA
> 998 0 (0.0%) 35.25
> 4.37 2.54
> ==============================================================
That works very well unless I have multiple simultaneous calls from one IP. In such situation it will be good to check RTP stats per IP and dialed number (to distinct calls) and get results on per-call basis
Any thoughts how to correlate above stats with dialed numbers?
Can you show an example output of the "multiple simultaneous calls from one IP" situation?
Sourc/dest port are randomized each call, so basically you get multiple lines like above with same IP but different ports