Re: VoIP RTP Analysis, Lost Packet Analysis

[Jake Peavy <djstunks () gmail com>]

On Sat, Apr 9, 2011 at 9:20 PM, Jake Peavy <djstunks () gmail com> wrote:

> On Sat, Apr 9, 2011 at 8:23 AM, Barry Constantine <
> Barry.Constantine () jdsu com> wrote:
>
> > Hi,
> >
> >
> >
> > I am analyzing VoIP capture files in Wireshark 1.4 and am confused about
> > the RTP analysis results.
> >
> >
> >
> > The jitter results match what I expect, but the packet loss results do
> > not.
> >
> >
> >
> > I know for a fact that the file contains no packet loss and yet the RTP
> > analysis screen reports all packets as lost “negatively” (and gives an odd
> > -100% value).
> >
> >
> >
> > Any ideas?
>
>
> Can you post a sample capture? <http://deepthoughtsbyjackhandey.com>

It looks ok to me, Barry.  I'm not on the same version as you, but mine is
older.

You have to decode your stream as RTP, perhaps that's the missing step?  At
least on my version the heuristics did not identify your stream as RTP.


$ tshark -v
TShark 1.2.1 (SVN Rev 29141)

Copyright 1998-2009 Gerald Combs <gerald () wireshark org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.20.3, with WinPcap (version unknown), with libz 1.2.3,
without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8, with c-ares
1.6.0,
with Lua 5.1, with GnuTLS 2.8.1, with Gcrypt 1.4.4, with MIT Kerberos, with
GeoIP.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1
beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS
2.8.1,
Gcrypt 1.4.4.

Built using Microsoft Visual C++ 9.0 build 30729

$ tshark -r VoIP_Communicator_Snippet.pcap -d"udp.port==50056,rtp" -qz
rtp,streams
========================= RTP Streams ========================
    Src IP addr  Port    Dest IP addr  Port       SSRC          Payload
Pkts         Lost   Max Delta(ms)  Max Jitter(ms) Mean Jitter(ms) Problems?
  102.1.145.163 50056  244.55.112.179 50048 0xABBCE50F     Unknown(118)
1     0 (0.0%)            0.00            0.00         0.00
 244.55.112.179 50048   102.1.145.163 50056 0x726E7E61     Unknown(118)
40     0 (0.0%)            0.00            0.00         0.00
==============================================================

-- 
-jp

Do you know what happens when you slice a golf ball in half? Someone gets
mad at you. I found this out the hard way.

deepthoughtsbyjackhandey.com

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe