Wireshark-users: Re: [Wireshark-users] Why does wireshark decode AMB-WR data as "Octet-Aligned Mo

From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 21 Sep 2021 01:53:52 -0700
On Sep 21, 2021, at 1:17 AM, Nan Xiao <xiaonan830818@xxxxxxxxx> wrote:

> I have an original pcap file whose RTP payload type is AMR-WB, and it
> uses "Octet-Aligned Mode" to encode data. Then I just changed the
> octet-align from 1 to 0 in SIP/SDP message (The 1st packet, fmtp:123
> octet-align=0), and hope the wireshark can assume the data as
> "Bandwidth-Efficient Mode", but the wireshark still decodes the AMR-WB
> encoding as "Octet-Aligned Mode".

The AMR dissector currently has no mechanism by which it can get an indication of whether octet-aligned or bandwidth-efficient mode is used, other than by a preference setting for the AMR protocol.

You can work around this in Wireshark by opening up the Preferences dialog, opening up the "Protocols" list, going to the "AMR" entry in that list, and setting the "Type of AMR encoding of the payload" to "RFC 3267n BW-efficient".

If you want the AMR dissector to get that information from the SIP messages used to set up the conversation (if those messages are available!), please file an enhancement request at

	https://gitlab.com/wireshark/wireshark/-/issues

Attach your capture to the issue.