Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Jitter wrong in wireshark?

From: "Anders Broman" <a.broman@xxxxxxxxx>
Date: Sat, 24 Feb 2007 18:03:00 +0100
Hi,
Looking at the sources there is code there to use different frequencies
But for dynamic payload types there are two prerequisites that must be met:
- The setup signalling must be in the traces for Wireshark to track the
PT to the media type.
- The media type sampling frequency must be in the table of rtp_analysis.c

This types are currently specified:
static const mimetype_and_clock mimetype_and_clock_map[] = {
	{"AMR",		8000},  /* [RFC3267] */
	{"AMR-WB",	16000},  /* [RFC3267] */
	{"EVRC",	8000},  /* [RFC3558] */
	{"EVRC0",	8000},  /* [RFC3558] */
	{"G7221",	16000},  /* [RFC3047] */
	{"G726-16",	8000},  /* [RFC3551] */
	{"G726-24",	8000},  /* [RFC3551] */
	{"G726-32",	8000},  /* [RFC3551] */
	{"G726-40",	8000},  /* [RFC3551] */
	{"G729D",	8000},  /* [RFC3551] */
	{"G729E",	8000},  /* [RFC3551] */
	{"GSM-EFR",	8000},  /* [RFC3551] */
	{"mpa-robust",	90000},  /* [RFC3119] */
	{"SMV",		8000},  /* [RFC3558] */
	{"SMV0",	8000},  /* [RFC3558] */
	{"red",		1000},  /* [RFC4102] */
	{"t140",		1000},  /* [RFC4103] */
	{"BMPEG",	90000},  /* [RFC2343],[RFC3555] */
	{"BT656",	90000},  /* [RFC2431],[RFC3555] */
	{"DV",		90000},  /* [RFC3189] */
	{"H263-1998",	90000},  /* [RFC2429],[RFC3555] */
	{"H263-2000",	90000},  /* [RFC2429],[RFC3555] */
	{"MP1S",	90000},  /* [RFC2250],[RFC3555] */
	{"MP2P",	90000},  /* [RFC2250],[RFC3555] */
	{"MP4V-ES",	90000},  /* [RFC3016] */
	{"pointer",	90000},  /* [RFC2862] */
	{"raw",		90000},  /* [RFC4175] */
};
Best regards
Anders



-----Ursprungligt meddelande-----
Från: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För Juan.Wortley@xxxxxxxxx
Skickat: den 24 februari 2007 17:45
Till: wireshark-users@xxxxxxxxxxxxx
Ämne: Re: [Wireshark-users] Jitter wrong in wireshark?

Hi Anders,

Yes, your are right. Codecs affect jitter calculation because of the
sampling frequency. In practice, it affects when calculating the timestamp
to seconds. I.e: when multipling timestamp ticks to convert to seconds one
must use the frequency sampling of the current codec. As wireshark uses
always 0.000125 (it looks like this is not configurable), then if codec is
not G711 calculations will be wrong. 

And that´s my case :(
BR
Juan






>-----Original Message-----
>From: wireshark-users-bounces@xxxxxxxxxxxxx 
>[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of 
>ext Anders Broman
>Sent: Sábado, 24 de Febrero de 2007 04:50 a.m.
>To: 'Community support list for Wireshark'
>Subject: Re: [Wireshark-users] Jitter wrong in wireshark?
>
>Hi,
>If I understood the previous discussion correctly the RTP 
>timestamp which is based on the sampling frequency is used in 
>the calculations. If the wrong sampling frequency is used the 
>calculations will be off.
>
>If a dynamic PT is used (>95) it probably not G711.
>Best regards
>Anders
>
>________________________________________
>Från: wireshark-users-bounces@xxxxxxxxxxxxx
>[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För 
>Juan.Wortley@xxxxxxxxx
>Skickat: den 23 februari 2007 18:29
>Till: wireshark-users@xxxxxxxxxxxxx
>Ämne: Re: [Wireshark-users] Jitter wrong in wireshark?
>
>Hi Anders,
>good question. I´m not sure but I guess is codec is PCMA G711 
>8KHz (will take a look during call setup in a couple of hours).
> 
>However "Payload type" is 97 (0x61), and wireshark shows it as 
>"Payload type=Unknown"
> 
>According to the formula, jitter calculation depends on 
>timestamps and arrival time differences. I don´t know how 
>codec could affect.
> 
>BR
>Juan
> 
>
>________________________________________
>From: wireshark-users-bounces@xxxxxxxxxxxxx
>[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of 
>ext Anders Broman (AL/EAB)
>Sent: Viernes, 23 de Febrero de 2007 01:05 p.m.
>To: Community support list for Wireshark
>Subject: SV: [Wireshark-users] Jitter wrong in wireshark?
>Hi,
>Which codec is used?
>Best regards
>Anders
>
>________________________________________
>Från: wireshark-users-bounces@xxxxxxxxxxxxx genom 
>Juan.Wortley@xxxxxxxxx
>Skickat: fr 2007-02-23 16:53
>Till: wireshark-users@xxxxxxxxxxxxx
>Ämne: [Wireshark-users] Jitter wrong in wireshark?
>Hi All,
>Below is a rtp analysis from a wireshark 0.99.5 capture in a 
>live network. 
>Doing by hand jitter calculation it doesn´t match. And of 
>course, if below data is real it means we are having jitter of 
>more than 1 minute !!
>Exampe: first jitter should be 138.90/16 = 8.68125 [ms] and is showing
>8803,82 [ms] !!! 
>Do someone know what could be wrong or what I´m missing? 
>BR
>Juan 
>
>Forward Packet  Sequence        Delta (ms)      Jitter (ms)    
> IP BW (kbps) Marker  Status  Date    Length
>1       0       0.00    0.00    1.45            [ Ok ]  02/19/2007
>18:44:25.915 231
>2       1       138.90  8803.82 2.90            [ Ok ]  02/19/2007
>18:44:26.053 231
>3       2       119.59  17058.61        4.34            [ Ok ] 
> 02/19/2007
>18:44:26.173 231
>4       3       139.67  24796.21        5.79            [ Ok ] 
> 02/19/2007
>18:44:26.313 231
>5       4       180.22  32047.69        7.24            [ Ok ] 
> 02/19/2007
>18:44:26.493 231
>6       5       241.67  38842.10        8.69            [ Ok ] 
> 02/19/2007
>18:44:26.735 231
>7       6       96.71   45220.93        10.14           [ Ok ] 
> 02/19/2007
>18:44:26.831 231
>8       7       198.41  51194.72        10.14           [ Ok ] 
> 02/19/2007 18:44:27.030 231
>9       8       205.78  56794.69        8.69            [ Ok ] 
> 02/19/2007
>18:44:27.235 231
>10      9       193.62  62045.42        8.69            [ Ok ] 
> 02/19/2007
>18:44:27.429 231
>11      10      197.77  66967.72        8.69            [ Ok ] 
> 02/19/2007
>18:44:27.627 231
>12      11      208.31  71581.72        7.24            [ Ok ] 
> 02/19/2007
>18:44:27.835 231
>13      12      190.92  75908.43        8.69            [ Ok ] 
> 02/19/2007
>18:44:28.026 231
>14      13      199.23  79964.20        8.69            [ Ok ] 
> 02/19/2007
>18:44:28.225 231
>15      14      183.31  83767.48        8.69            [ Ok ] 
> 02/19/2007
>18:44:28.409 231
>16      15      200.50  87331.98        8.69            [ Ok ] 
> 02/19/2007
>18:44:28.609 231
>17      16      216.07  90672.73        8.69            [ Ok ] 
> 02/19/2007
>18:44:28.825 231
>18      17      137.81  93809.57        8.69            [ Ok ] 
> 02/19/2007
>18:44:28.963 231
>19      18      139.08  96750.28        8.69            [ Ok ] 
> 02/19/2007
>18:44:29.102 231
>20      19      119.60  99508.41        10.14           [ Ok ] 
> 02/19/2007
>18:44:29.222 231
>21      20      119.59  102094.16       10.14           [ Ok ] 
> 02/19/2007
>18:44:29.341 231
>22      21      119.18  104518.33       10.14           [ Ok ] 
> 02/19/2007 18:44:29.460 231
>23      22      126.80  106790.51       11.58           [ Ok ] 
> 02/19/2007
>18:44:29.587 231
>24      23      112.05  108921.60       11.58           [ Ok ] 
> 02/19/2007
>18:44:29.699 231
>25      24      145.14  110917.43       11.58           [ Ok ] 
> 02/19/2007
>18:44:29.844 231
>26      25      115.57  112790.36       13.03           [ Ok ] 
> 02/19/2007 18:44:29.960 231
>27      26      118.57  114546.05       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.079 231
>28      27      139.44  116190.71       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.218 231
>29      28      120.40  117733.77       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.338 231
>30      29      118.59  119180.49       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.457 231
>31      30      120.00  120536.71       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.577 231
>32      31      120.23  121808.15       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.697 231
>33      32      119.60  123000.17       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.817 231
>34      33      118.72  124117.74       13.03           [ Ok ] 
> 02/19/2007
>18:44:30.936 231
>35      34      119.88  125165.39       13.03           [ Ok ] 
> 02/19/2007
>18:44:31.055 231
>36      35      146.42  126145.90       13.03           [ Ok ] 
> 02/19/2007
>18:44:31.202 231
>37      36      57.34   118265.37       11.90   SET     
>Incorrect timestamp     02/19/2007 18:44:31.259 90     
>                                                                       
>Reverse Packet  Sequence        Delta (ms)      Jitter (ms)    
> IP BW (kbps) Marker  Status  Date    Length
>44      1       0.00    0.00    1.45            [ Ok ]  02/19/2007
>18:44:36.119 231
>46      2       126.78  99992.08        2.90            [ Ok ] 
> 02/19/2007
>18:44:36.246 231
>47      3       293.16  193724.25       4.34            [ Ok ] 
> 02/19/2007
>18:44:36.539 231
>48      4       159.97  281606.49       5.79            [ Ok ] 
> 02/19/2007
>18:44:36.699 231
>49      5       119.98  363998.58       7.24            [ Ok ] 
> 02/19/2007
>18:44:36.819 231
>50      6       160.07  441238.67       8.69            [ Ok ] 
> 02/19/2007
>18:44:36.979 231
>51      7       261.00  513644.94       8.69            [ Ok ] 
> 02/19/2007 18:44:37.240 231
>52      8       43.09   481544.82       7.56    SET     
>Incorrect timestamp     02/19/2007 18:44:37.283 90 
>_______________________________________________
>Wireshark-users mailing list
>Wireshark-users@xxxxxxxxxxxxx
>http://www.wireshark.org/mailman/listinfo/wireshark-users
>
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users