Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Interpretting a VoIP call

Date: Tue, 14 Nov 2006 16:23:18 +0000
On 11/14/06, Razor Ramone <razor.ramone@xxxxxxxxx> wrote:
Hello,

for my school project, I decided to analyze a VoIP call using wireshark but
there are some things that are not clear to me.
below, I am always talking about RTP packets

first of all, in a conversation, I expect that the initiator and the
receiver take turns talking. Therefore, I expected to see that when the
initiator is sending packets (talking), the receiver is listening (not
sending packets), but that is not the case in my Wireshark captures.
What I see is that the receiver generally sends packets continuously at a
frequency of 1 packet every 20ms.

On the other hand, the receiver is simultaneously sending packets in a
different pattern. The receiver sends 4 to 5 packets almost at instantly (
0.0x ms between each packet), then it waits 80 to 100ms during which it
receives 4 to 5 packets from the initiator, then it sends another burst of
4-5 packets.

So my questions so far are
-Why do initiator and receiver send packets simultaneously?
may full-duplex be the answer?

-Why do initiator send packets in different patterns? (20ms vs a burst of
packets followed by a wait)
Buffering problems, network congestion, transport problems, etc...
that should be seen on case per case basis.


The answer to my first question, I suspect, would be noise, or synhetic
noise was introduced into the conversation on purpose (comfort noise) but I
am not sure about this.
That can be.

My final question is:
-If it is true that the reasons initiator and receiver send packets at the
same time, why, then, are there times that they do not send packets at the
same time? (in one conversation, the initiator is talking for an extensive
period of time during which the receiver sends no packets)
may silence-suppression be the answer?


_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users




--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan