ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] Save RTP Stream for both sides Conversation

From: firstname lastname <psykosonik_frequenz@xxxxxxxxx>
Date: Thu, 1 Sep 2011 02:14:37 -0700 (PDT)
Hi,

I have a network capture file consisting of a conversation made using VoIP. However, when I go to telephony -> VoIP Calls, it doesn't detect any VoIP Calls. My guess is that since it didn't capture the call setup messages as well, so no VoIP Calls are detected.

So, in order to listen to the conversation, I decided to listen to the RTP Stream.

No frames were detected as RTP. There were many UDP frames. Assuming that RTP packets got detected as UDP.

I selected one UDP Packet among the huge array of many consecutive UDP packets. Right clicked on it, selected "Decode As RTP".

Now, these frames appeared as RTP in the network capture file.

Next, I wanted to save this RTP Conversation. I followed this approach:

Telephony -> RTP -> Show All Streams

It showed two streams.

Between Party A and Party B
Between Party B and Party A

each of these streams have only "one way conversation" saved in them.

To save the payload, I selected one stream, clicked on Analyze and in the new pop up window, clicked, on Save Payload (with raw and forward selected).

The format selected was .ul.

I used SoX to convert this to a wav format.

sox test.ul test.wav

Now when I play this media file using Windows Media Player, only one side conversation is played. Which means I can hear only Party A talking.

Next, I selected the second stream, between Party B and A, this time around, following the same steps as above to save the conversation. I was able to listen to Party B's conversation.

My question is, how do I save the streams in such a way that I can listen to the conversation of both the parties in the same file?

I tried selecting both the streams at once and followed the above approach. It by default saved the conversation only for the first source in the list.

Thanks.
Regards,
NeonFlash