On 06-04-17 22:01, Guy Harris wrote:
> On Apr 6, 2017, at 12:49 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
>
>> Have a look in your configuration file heuristic_protos. There's this entry:
>> rtp_udp,1
>> If it says '0' instead change it to '1'.
>> You can do this via the GUI, go to menu Analyze|Enabled Protocols...
>> Then search for RTP, and enable rtp_udp. Then leave the GUI and try tshark again
>> from the command line. It uses the same configuration files, so it should be
>> fine now.
>
> Or try running tshark with the command-line option
>
> --enable-heuristic rtp_udp
>
> which will enable it for that *particular* instance of tshark without making it a permanent setting.
... but isn't it always the same story; "how to get UDP dissected as RTP"? I
can't remember the question being asked the other way around....
