Ask Your Question

Why is Wireshark reporting Skype traffic on a network with no Skype traffic?

asked 2019-05-13 18:18:37 +0000

netsuke gravatar image

updated 2019-05-14 06:32:21 +0000

Guy Harris gravatar image

I played a rtsp video-stream with vlc, the wireshark detects rtp-traffic and skype-packet, but I don't use skype. I consider that wireshark take its traffic for another. Why wireshark recognize traffic with errors?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-05-14 06:31:09 +0000

Guy Harris gravatar image

Because not all network protocols have a property in the protocol data, or in the protocol atop which the protocol in question runs, that allows it to be uniquely identified as traffic for a given protocol. Therefore, Wireshark uses heuristics to try to identify the protocol as best as it can, but heuristics can guess incorrectly.

The current heuristic for Skype is "a UDP packet with 3 or more bytes, and with the lower 4 bits of the 3rd byte being one of 0x2, 0x3, 0x5, 0x7, 0xd, or 0xf, is assumed to be a Skype packet". That's a rather weak heuristic; perhaps it could be strengthened - the code has the comment "FIXME: Extend this by minimum or exact length per message type".

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-05-13 18:18:37 +0000

Seen: 731 times

Last updated: May 14 '19