Ask Your Question
0

Discrepancy in RTP Stream Analysis Max Delta Calculation​

asked 2025-07-24 13:03:15 +0000

In Wireshark's RTP stream analysis (Telephony → RTP → RTP Stream Analysis), the reported "Max Delta" value appears inconsistent with the actual packet timings.

​​Observed Behavior:​​

The analysis panel shows: Max Delta: 21.83000 ms @ packet 16 However, in the detailed packet list (right panel), packet #17 shows: Delta: 162.508 ms ​​Expected Behavior:​​ The "Max Delta" value should accurately reflect the largest inter-packet delay found in the stream (which appears to be 162.508 ms at packet #17).

​​Supporting Evidence:​​

Screenshot: https://obeoss-eu.oss-eu-central-1.al... PCAP file: https://obeoss-eu.oss-eu-central-1.al... ​​Request:​​ Could you please: Explain why the reported Max Delta doesn't match the actual maximum delay observed? Suggest how to obtain the true maximum inter-packet delta for this stream?

edit retag flag offensive close merge delete

Comments

Can you update the question with output of wireshark -v or copy text from Help->About Wireshark:Wireshark tab.

Chuckc gravatar imageChuckc ( 2025-07-24 13:17:13 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2025-07-24 13:53:09 +0000

Chuckc gravatar image

updated 2025-07-24 14:03:34 +0000

The Marker flag is set on frame 18 so not included in the Max Delta calculations.

There is an example in the WSUG (Figure 9.9. The “RTP Stream Analysis” window) that shows two Marker frames not included in the Max Delta calculation.

ui/tap-rtp-analysis.c:

    /* Is it a regular packet? */
    if (!(statinfo->flags & STAT_FLAG_FIRST)
            && !(statinfo->flags & STAT_FLAG_MARKER)
            && !(statinfo->flags & STAT_FLAG_PT_CN)
            && !(statinfo->flags & STAT_FLAG_WRONG_TIMESTAMP)
            && !(statinfo->flags & STAT_FLAG_FOLLOW_PT_CN)) {
        /* Include it in maximum delta calculation */
        if (statinfo->delta > statinfo->max_delta) {
            statinfo->max_delta = statinfo->delta;
            statinfo->max_nr = pinfo->num;
        }

image description

Frame 18: 436 bytes on wire (3488 bits), 436 bytes captured (3488 bits)
Linux cooked capture v2
Internet Protocol Version 4, Src: 192.168.49.166 (192.168.49.166), Dst: 192.168.49.1 (192.168.49.1)
User Datagram Protocol, Src Port: 23704 (23704), Dst Port: 19900 (19900)
Real-Time Transport Protocol
    [Stream setup by HEUR RTP (frame 1)]
    10.. .... = Version: RFC 1889 Version (2)
    ..0. .... = Padding: False
    ...0 .... = Extension: False
    .... 0000 = Contributing source identifiers count: 0
    1... .... = Marker: True
    Payload type: MPEG-II transport streams (33)
    Sequence number: 17
    [Extended sequence number: 65553]
    Timestamp: 906791582
    [Extended timestamp: 5201758878]
    Synchronization Source identifier: 0xdeadbeef (3735928559)
<snip>
edit flag offensive delete link more

Comments

Got it, thanks!

mactensor gravatar imagemactensor ( 2025-07-25 02:53:36 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2025-07-24 13:03:15 +0000

Seen: 27 times

Last updated: yesterday