Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9021] RTP not decoded inside the conversation in v.1.10.1

Date: Wed, 05 Mar 2014 03:52:39 +0000

Comment # 4 on bug 9021 from
[this is more of a note to myself than anything else, before I forget it while
I'm working on bug 9835]

It turns out this bug is not exactly the same as bug 9835, though there is
overlap. The reason the UDP packets aren't being dissected as RTP in this one
are:

1) There's no 2xx response to finalize the SIP session setup. There's an INVITE
w/SDP and a 183 w/SDP, but the initial dialog eventually gets torn down by a
CANCEL.  Unfortunately, the wireshark code currently only really deals with RTP
dissection when it sees a 2xx class response with SDP answer. (that's a bug, by
the way)

2) Oddly, the 183 falls through the packet-sip.c code and ends up being
dissected by SDP *anyway*, in dissector_try_string(), and that does setup the
RTP conversation for the addr:port that was in the 183's SDP (but not the
INVITE's).  Ironically, in the attached capture the media ends up only going
to/from the UDP addr:port of the INVITE's SDP, not the 183's, so it doesn't
dissect even that one stream direction, by pure chance. So basically this is a
very unlucky capture. :)

I'm not sure if the 183 should in fact fall through to be dissected in
dissector_try_string() or not, so that may be another bug.


You are receiving this mail because:
  • You are watching all bug changes.