Ask Your Question

How to correlate output of tshark rtp.heuristic_rtp:TRUE with dialed phone numbers

asked 2018-02-19 11:31:43 +0000

mat_wwa gravatar image

updated 2018-02-19 11:50:27 +0000

I'm running VoIP server and use tshark to monitor RTP streams quality

I use something like this command:

> tshark -q -f 'udp portrange 16384-32768' -o rtp.heuristic_rtp:TRUE -z rtp,streams

And get nice output with RTP stats per client IP address:

> ========================= RTP Streams ========================
>     Src IP addr  Port    Dest IP addr  Port       SSRC          Payload  Pkts 
> Lost   Max Delta(ms)  Max Jitter(ms)
> Mean Jitter(ms) Problems?
>  5291 20174 0x50C709D4 ITU-T G.711 PCMA  
> 998     0 (0.0%)           35.25      
> 4.37            2.54
> ==============================================================

That works very well unless I have multiple simultaneous calls from one IP. In such situation it will be good to check RTP stats per IP and dialed number (to distinct calls) and get results on per-call basis

Any thoughts how to correlate above stats with dialed numbers?

edit retag flag offensive close merge delete


Can you show an example output of the "multiple simultaneous calls from one IP" situation?

Jaap gravatar imageJaap ( 2018-02-19 12:45:26 +0000 )edit

Sourc/dest port are randomized each call, so basically you get multiple lines like above with same IP but different ports

mat_wwa gravatar imagemat_wwa ( 2018-02-19 12:48:54 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2018-02-19 14:16:56 +0000

Anders gravatar image

You need the control signaling SIP? to see which port are assigned in a particular call. In the case of SIP the SDP data.

edit flag offensive delete link more


Sure, I can change filter to monitor also for port used by SIP session management. The question is how to easily combine tshark's "RTP Streams" output with TO URI extracted from the initial SIP INVITE messages. Basically I need to extend RTP Streams output with TO URI column

mat_wwa gravatar imagemat_wwa ( 2018-02-19 15:29:17 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-02-19 11:31:43 +0000

Seen: 30 times

Last updated: Feb 19