Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] RTCP frame length error indication in RTCP with a Bye chunk

From: "Herculano Antonio Lambert Duarte" <hduarte@xxxxxxxxxxx>
Date: Thu, 20 Dec 2007 12:34:01 -0200
Hi!

When the RTCP packet has a BYE chunk included, there is an expert message "RTCP frame length check: wrong (expected 104 bytes, found 108)" (the numbers belong to an example captured in field test), but the number of octets is correct (see the example below).

===
Frame 1457 (146 bytes on wire, 146 bytes captured)
Ethernet II, Src: TróPicoS_00:00:99 (00:1a:90:00:00:99), Dst: Unispher_40:68:71 (00:90:1a:40:68:71)
Internet Protocol, Src: 200.168.14.107 (200.168.14.107), Dst: 200.168.13.203 (200.168.13.203)
User Datagram Protocol, Src Port: 32061 (32061), Dst Port: 5273 (5273)
Real-time Transport Control Protocol (Sender Report)
    [Stream setup by SDP (frame 260)]
    10.. .... = Version: RFC 1889 Version (2)
    ..0. .... = Padding: False
    ...0 0001 = Reception report count: 1
    Packet type: Sender Report (200)
    Length: 12 (52 bytes)
    Sender SSRC: 0x12345678 (305419896)
    Timestamp, MSW: 29 (0x0000001d)
    Timestamp, LSW: 3444563771 (0xcd4fdf3b)
    [MSW and LSW as NTP timestamp: Feb  7, 2036 06:28:45,8020 UTC]
    RTP timestamp: 1476661580
    Sender's packet count: 300
    Sender's octet count: 4236
    Source 1
Real-time Transport Control Protocol (Source description)
    [Stream setup by SDP (frame 260)]
    10.. .... = Version: RFC 1889 Version (2)
    ..0. .... = Padding: False
    ...0 0001 = Source count: 1
    Packet type: Source description (202)
    Length: 6 (28 bytes)
    Chunk 1, SSRC/CSRC 0x12345678
Real-time Transport Control Protocol (Goodbye)
    [Stream setup by SDP (frame 260)]
    10.. .... = Version: RFC 1889 Version (2)
    ..0. .... = Padding: False
    ...0 0001 = Source count: 1
    Packet type: Goodbye (203)
    Length: 5 (24 bytes)
    Identifier: 0x12345678 (305419896)
    Length: 15
    Text: session stopped
[RTCP frame length check: Wrong (expected 104 bytes, found 108)]
===

Herculano A. L. Duarte