Tshark doesnt detect RTP with "rtp.heuristic_rtp: TRUE" enabled

RTP
tshark

asked 2021-02-14 22:23:05 +0000

wshark_de
7 ●1 ●4 ●7

updated 2021-02-14 22:47:51 +0000

Hi, I want Tshark to output RTP statistics to a textfile, but it only works in one direction. Reason is that in wireshark you need to "decode as" the packets as "STUN" packets, because sending side RTP is encapsulated inside STUN (receiving side works fine). Then it is correctly detected and handled as RTP traffic (picture) in wireshark, but not in tshark. :( I specified the working (decode as)Wireshark profile, but tshark still only show RTP statistics for one direction.

tshark.exe -r .\Teams.pcapng -C "UDP VOIP (STUN)" -o "rtp.heuristic_rtp: TRUE" -qz rtp,streams >text.txt

Questions:

1) Anyone knows how to make it work with tshark? Or...

2) Can you remove STUN headers with tshark/editcap so that it is detected as RTP traffic?

Thank you

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2021-02-14 22:36:48 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Does this need a second pass. i.e. the -2 flag?

edit flag offensive delete link

Comments

Update: It works! Thanks for your reply. Unfortunately this did not change the result: tshark.exe -2 -r .\teams.pcapng -C "UDP VOIP (STUN)" -o "rtp.heuristic_rtp: TRUE" -qz rtp,streams >text.txt

wshark_de ( 2021-02-14 23:43:27 +0000 )edit

Works. Thanks

wshark_de ( 2021-02-14 23:49:19 +0000 )edit

I've converted my comment to an answer. Just to confirm as your comments aren't clear, adding the -2 flag fixes your issue? If so could you accept the answer by clicking the checkmark icon to the left of it, we don't close answered questions here?

grahamb ( 2021-02-15 08:24:25 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-02-14 22:23:05 +0000

Seen: 272 times

Last updated: Feb 14 '21

Tshark doesnt detect RTP with "rtp.heuristic_rtp: TRUE" enabled edit