Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2560] editcap -c option drops data

Date: Sun, 25 May 2008 02:56:35 -0700 (PDT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2560


Kangatel <graham.lynas@xxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID




--- Comment #2 from Kangatel <graham.lynas@xxxxxxxxx>  2008-05-25 02:56:35 PDT ---
(In reply to comment #1)
> So, I guess the call setup information is in the first file, together with the
> properly decoded RTP/RTCP data. While in the second file there is only RTP/RTCP
> data?
> 
> What happens is that Wireshark learns from the call setup information what UDP
> packets to interpret as RTP/RTCP. If you load the second file, it can't learn
> that since there's no call set info, so it stops at the UDP layer.
> 
> What if you go into the protocol preferences for RTP/RTCP and enable "Try to
> decode RT(C)P outside of conversations". Does it now show your RTP/RTCP
> packets? 
> 

Jaap

You are 100% correct in your analysis of the problem and your proposed
solution. Going into Preferences>Protocols and turning on the translate outside
conversations resulted in all the RTP and RTCP packets being translated
correctly.

I have updated this bug status to INVALID as it is not a bug with the Wireshark
software, but a software malfunction of my brain interface.

Thanks and Regards,

Graham


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.