Ask Your Question
0

Why would I be getting "LEN 1 (Malformed Packet)"... "(Malformed Packet: RTCP)" on UDP Packets

asked 2017-11-14 16:40:30 +0000

Tools gravatar image

We are communicating across separate VLANS with a Router in between, and can access field switches and successfully ping all field devices. The system manufacturer notes that they are seeing UDP traffic sent out by the system server, but that the server isn't receiving responses. I ran captures in Wireshark with the following results. Any idea why UDP packets would be reported as "Malformed" ... "Malformed Packet: RTCP"?

Any help would be appreciated. Capture included.

edit retag flag offensive close merge delete

Comments

Have you sliced the frames during capture?

Christian_R gravatar imageChristian_R ( 2017-11-14 16:47:21 +0000 )edit

Can you share us a trace?

Here is a tutorial how you can share pcaps at Wireshark Q&A: https://blog.packet-foo.com/2016/11/t... the trace file is not so big you can attach it directly here, if you press the "attach a file" button at the answer field

Christian_R gravatar imageChristian_R ( 2017-11-14 19:14:03 +0000 )edit

Also check your preferences. Is there an UDP port configured for the RTCP protocol?

Jaap gravatar imageJaap ( 2017-11-14 20:42:30 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2025-06-09 15:22:19 +0000

gielo gravatar image

Numbering of RTCP packets must adhere to RFC 3550. Please see section about odd and even port numbering. Most PABX manufacturers adhere to this ruling. Basically, all RTP packets must carry an even port number and RTCP packets must carry an odd number. For example: If your RTP port number is 2000 then your RTCP associated port number would be 2001. RTCP port number is always one value higher than that of the RTP port. TEAMS does however not adhere to RFC3550 and as a result you will see odd and even numbered ports. This Wireshark will mark as malformed

edit flag offensive delete link more

Comments

Does RFC 5761 have any bearing here?

grahamb gravatar imagegrahamb ( 2025-06-09 15:26:14 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2017-11-14 16:40:30 +0000

Seen: 46,652 times

Last updated: Jun 09