On Apr 6, 2017, at 1:04 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
> ... but isn't it always the same story; "how to get UDP dissected as RTP"? I
> can't remember the question being asked the other way around....
Enabling the heuristic solves two problems: "how to get UDP traffic that's RTP traffic dissected as RTP" and "how to get UDP traffic that's *not* RTP traffic *mis*dissected as RTP". :-) It's a *very* weak heuristic, and could get a lot of non-RTP traffic misdissected as RTP.
Therefore, you might not want to permanently turn the heuristic dissector on - you might want to turn it on for some captures but leave it off for others.