Ask Your Question

Tshark doesnt detect RTP with "rtp.heuristic_rtp: TRUE" enabled

asked 2021-02-14 22:23:05 +0000

wshark_de gravatar image

updated 2021-02-14 22:47:51 +0000

Hi, I want Tshark to output RTP statistics to a textfile, but it only works in one direction. Reason is that in wireshark you need to "decode as" the packets as "STUN" packets, because sending side RTP is encapsulated inside STUN (receiving side works fine). Then it is correctly detected and handled as RTP traffic (picture) in wireshark, but not in tshark. :( I specified the working (decode as)Wireshark profile, but tshark still only show RTP statistics for one direction.

tshark.exe -r .\Teams.pcapng -C "UDP VOIP (STUN)" -o "rtp.heuristic_rtp: TRUE" -qz rtp,streams >text.txt


1) Anyone knows how to make it work with tshark? Or...

2) Can you remove STUN headers with tshark/editcap so that it is detected as RTP traffic?

Thank you

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-02-14 22:36:48 +0000

grahamb gravatar image

Does this need a second pass. i.e. the -2 flag?

edit flag offensive delete link more


Update: It works! Thanks for your reply. Unfortunately this did not change the result: tshark.exe -2 -r .\teams.pcapng -C "UDP VOIP (STUN)" -o "rtp.heuristic_rtp: TRUE" -qz rtp,streams >text.txt

wshark_de gravatar imagewshark_de ( 2021-02-14 23:43:27 +0000 )edit

Works. Thanks

wshark_de gravatar imagewshark_de ( 2021-02-14 23:49:19 +0000 )edit

I've converted my comment to an answer. Just to confirm as your comments aren't clear, adding the -2 flag fixes your issue? If so could you accept the answer by clicking the checkmark icon to the left of it, we don't close answered questions here?

grahamb gravatar imagegrahamb ( 2021-02-15 08:24:25 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-02-14 22:23:05 +0000

Seen: 37 times

Last updated: Feb 14