Ask Your Question

Basti's profile - activity

2021-07-13 13:52:13 +0000 received badge  Popular Question (source)
2020-11-12 02:28:00 +0000 received badge  Famous Question (source)
2020-11-12 02:28:00 +0000 received badge  Notable Question (source)
2018-11-30 15:28:29 +0000 commented question Disable rpcap-interface discovery on startup

@grahamb Stop Wireshark, try deleting the entries from the file, restart Wireshark. This works only for the next s

2018-11-30 15:27:40 +0000 answered a question Disable rpcap-interface discovery on startup

Stop Wireshark, try deleting the entries from the file, restart Wireshark. This works only for the next startup.

2018-11-30 14:33:19 +0000 answered a question Disable rpcap-interface discovery on startup

Has anybody a solutions for this problem?

2018-10-22 22:21:51 +0000 received badge  Popular Question (source)
2018-09-18 08:46:29 +0000 asked a question Disable rpcap-interface discovery on startup

Disable rpcap-interface discovery on startup Hi together, is there any hidden option to disable the rpcap-interface dis

2018-05-29 12:04:26 +0000 answered a question Decode TURN Traffic as RTP

Great! - Thanks for the fast response! For that protocol, the RTP and RTCP dissectors are registered as heuristic di

2018-05-29 12:03:12 +0000 marked best answer Decode TURN Traffic as RTP

Hey Guys,

i dont find a stable solution to convert recorded TURN Traffic with Wireshark to a RTP Stream to analyze it. Hope you can help me :)

If I have a tcp dump with a Turn Session, I have the following Problem:

  • RTP is encapsulated in TURN | https://tools.ietf.org/rfc/rfc5766.txt

    11.4.  The ChannelData Message
    
    The ChannelData message is used to carry application data between the
    client and the server.  It has the following format:
    
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         Channel Number        |            Length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                                                               |
    /                       Application Data                        /
    /                                                               /
    |                                                               |
    |                               +-------------------------------+
    |                               |
    +-------------------------------+
    
  • The TURN Packte bring 4 bytes around the RTP Data and will be encoded as STUN packet image description

  • Use the "decode as" function does'nt help, because Wireshark then will interpret the TURN header as RTP header with it result in a wrong RTP Version. (RTP Version=1)

Is there any way to remove the enclosing 4bytes from the TURN header (without export manual search&replace) to decode the package as RTP?

The goal should be to see the RTP Header, and can work with the Stream in VoIP::RTP::RTP Stream

Thanks and best regards, Basti

2018-05-29 12:03:12 +0000 received badge  Scholar (source)
2018-05-25 09:34:52 +0000 received badge  Organizer (source)
2018-05-25 09:34:34 +0000 received badge  Editor (source)
2018-05-25 09:34:34 +0000 edited question Decode TURN Traffic as RTP

Decode TURN Traffic as RTP Hey Guys, i dont find a stable solution to convert recorded TURN Traffic with Wireshark to a

2018-05-25 09:20:23 +0000 asked a question Decode TURN Traffic as RTP

Decode TURN Traffic as RTP Hey Guys, i dont find a stable solution to convert recorded TURN Traffic with Wireshark to a