Hi! I catch a problem when used command
tshark -r from_test.pcap --enable-protocol rtp -d rtp.pt==112,amr -O amr
I got the following output:
Adaptive Multi-Rate
[Payload decoded as: RFC 3267 bandwidth-efficient mode (1)]
0100 .... = CMR: AMR-WB 15.85 kbit/s (4)
.... 0... = F bit: Last frame in this payload
.... .000 0... .... = FT bits: AMR-WB 6.60 kbit/s (0) / Frame OK
.1.. .... = Q bit: Ok
Error: 13 Bytes available, 17 would be needed!
[Expert Info (Error/Malformed): Error: 13 Bytes available, 17 would be needed!]
[Error: 13 Bytes available, 17 would be needed!]
Message: Error: 13 Bytes available, 17 would be needed!
[Severity level: Error]
[Group: Malformed]
Malformed Packet
[Malformed Packet: AMR]
However, I expected to get AMR instead of AMR-WB, like in Wireshark:
Adaptive Multi-Rate
[Payload decoded as: RFC 3267 bandwidth-efficient mode (1)]
0010 .... = CMR: AMR 5,90 kbit/s (2)
.... 0... = F bit: Last frame in this payload
.... .001 0... .... = FT bits: AMR 5,90 kbit/s (2) / Frame OK
.1.. .... = Q bit: Ok
Frame Data: 7a567cd7f7f97a599ffef022206022
Both outputs from same pcap. What am I doing wrong while using tshark?
