Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] Problems saving RTP payload (G.711 PCMU)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Andrew Becherer <shadygrove@xxxxxxxxx>
Date: Mon, 13 Dec 2004 21:09:31 -0800
Hello all,

I am using ethereal to explore my Vonage VOIP service. I am using
etheral 0.10.7 built on Mac OS 10.3.6 using fink. I have a Cisco
ATA-186 analog telephone adapter and I am interested in its traffic.
As I am on a switched network I have been doing the capturing on the
my gateway(a PII box with smoothwall). I am limited to using tcpdump
for the capture, no big deal. From the ethereal docs I found out about
tcpdump (tcpdump -w <file-name> -s 1500 host <ip of cisco ata186>).

Now the trouble; I have been getting very spotty results on saving the
payload of the RTP streams in the .au audio format. I have tried 5
captures so far, and only 1 has been a complete success. In 4 of the
cases either the "forward direction" or the "reversed direction" will
not decode. Ethereal will return an error "Can't save reversed/forward
direction in a file: Unsupported codec!" I know this codec is
supported (G.711 PCMU). In each case I could save the payload of
either the forward or reversed stream but not both

Can anyone offer some advice for increasing the probability I will be
able to save the payload of both the forward and reversed stream?

I realize this feature has not been in ethereal too long(March of 2003
according to the developers list). I have done quite a bit of
googling/searching the mailing lists, I have tried using
vomit(different trouble there), and I just started trying rtptools and
the java media framework. I would prefer to just use ethereal. On the
one RTP stream it did a fantastic job.

-- 
Andrew B