Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Interpretting a VoIP call

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Tue, 14 Nov 2006 22:57:26 +0100 (CET)
Hi,

First back to the basis.
RTP is a real time transport protocol. This is just for transport of real
time data. How this real time transport is actually used depends on the
application.
The application in this case is a VoIP call, so speech data is send. Then
again there are various ways this is done, mainly depending on the speech
codec used.
A typical PCM codec (G.711) generates 8000 samples per second, usually
packaged in 20 to 30ms RTP packets. The reason for this is a tradeoff
between packatizing delay (delay from first sample, until packet is
compete to send) vs. overhead (RTP packets don't come cheap bytecount
wise)
The PCM codec generates a constant sample stream, so a constant packet
flow. With two parties involved in the call this results in two flows.
Clever suppression techniques avoid 'empty' packets from being
transmitted, but have to be accounted for at both ends.
The bursty nature of the packets you see is not normal, it contradicts the
real time nature of the protocol. It results in a deep jitter buffer and
long playout delay.

Thanx,
Jaap

On Tue, 14 Nov 2006, Razor Ramone wrote:

> Hello,
>
> for my school project, I decided to analyze a VoIP call using wireshark but
> there are some things that are not clear to me.
> below, I am always talking about RTP packets
>
> first of all, in a conversation, I expect that the initiator and the
> receiver take turns talking. Therefore, I expected to see that when the
> initiator is sending packets (talking), the receiver is listening (not
> sending packets), but that is not the case in my Wireshark captures.
> What I see is that the receiver generally sends packets continuously at a
> frequency of 1 packet every 20ms.
> On the other hand, the receiver is simultaneously sending packets in a
> different pattern. The receiver sends 4 to 5 packets almost at instantly (
> 0.0x ms between each packet), then it waits 80 to 100ms during which it
> receives 4 to 5 packets from the initiator, then it sends another burst of
> 4-5 packets.
>
> So my questions so far are
> -Why do initiator and receiver send packets simultaneously?
> -Why do initiator send packets in different patterns? (20ms vs a burst of
> packets followed by a wait)
>
> The answer to my first question, I suspect, would be noise, or synhetic
> noise was introduced into the conversation on purpose (comfort noise) but I
> am not sure about this.
>
> My final question is:
> -If it is true that the reasons initiator and receiver send packets at the
> same time, why, then, are there times that they do not send packets at the
> same time? (in one conversation, the initiator is talking for an extensive
> period of time during which the receiver sends no packets)
>