On Sat, Apr 9, 2011 at 9:20 PM, Jake Peavy
<djstunks@xxxxxxxxx> wrote:
On Sat, Apr 9, 2011 at 8:23 AM, Barry Constantine
<Barry.Constantine@xxxxxxxx> wrote:
Hi,
I am analyzing VoIP capture files in Wireshark 1.4 and am confused about the RTP analysis results.
The jitter results match what I expect, but the packet loss results do not.
I know for a fact that the file contains no packet loss and yet the RTP analysis screen reports all packets as lost “negatively” (and gives an odd -100% value).
Any ideas?
It looks ok to me, Barry. I'm not on the same version as you, but mine is older.
You have to decode your stream as RTP, perhaps that's the missing step? At least on my version the heuristics did not identify your stream as RTP.
$ tshark -v
TShark 1.2.1 (SVN Rev 29141)
Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GLib 2.20.3, with WinPcap (version unknown), with libz 1.2.3,
without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8, with c-ares 1.6.0,
with Lua 5.1, with GnuTLS 2.8.1, with Gcrypt 1.4.4, with MIT Kerberos, with
GeoIP.
Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1 beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS 2.8.1,
Gcrypt 1.4.4.
Built using Microsoft Visual C++ 9.0 build 30729
$ tshark -r VoIP_Communicator_Snippet.pcap -d"udp.port==50056,rtp" -qz rtp,streams
========================= RTP Streams ========================
Src IP addr Port Dest IP addr Port SSRC Payload Pkts Lost Max Delta(ms) Max Jitter(ms) Mean Jitter(ms) Problems?
102.1.145.163 50056 244.55.112.179 50048 0xABBCE50F Unknown(118) 1 0 (0.0%) 0.00 0.00 0.00
244.55.112.179 50048 102.1.145.163 50056 0x726E7E61 Unknown(118) 40 0 (0.0%) 0.00 0.00 0.00
==============================================================
--
-jp
Do you know what happens when you slice a golf ball in half? Someone gets mad
at you. I found this out the hard way.
deepthoughtsbyjackhandey.com