Re: VoIP RTP Analysis, Lost Packet Analysis

["RUOFF, LARS (LARS)** CTR **" <lars.ruoff () alcatel-lucent com>]

There's an issue indeed. Why is delta=0 for all packets in analysis?
Sorry, I don't have the time to look at the code right now.

Lars


________________________________

From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Jake Peavy
Sent: mercredi 13 avril 2011 22:42
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] VoIP RTP Analysis, Lost Packet Analysis


On Sat, Apr 9, 2011 at 9:20 PM, Jake Peavy <djstunks () gmail com> wrote:


        On Sat, Apr 9, 2011 at 8:23 AM, Barry Constantine <Barry.Constantine () jdsu com> wrote:
        

                Hi,

                 

                I am analyzing VoIP capture files in Wireshark 1.4 and am confused about the RTP analysis results.

                 

                The jitter results match what I expect, but the packet loss results do not.

                 

                I know for a fact that the file contains no packet loss and yet the RTP analysis screen reports all 
packets as lost "negatively" (and gives an odd -100% value).

                 

                Any ideas?



        Can you post a sample capture? <http://deepthoughtsbyjackhandey.com> 
        


It looks ok to me, Barry.  I'm not on the same version as you, but mine is older.

You have to decode your stream as RTP, perhaps that's the missing step?  At least on my version the heuristics did not 
identify your stream as RTP.



$ tshark -v
TShark 1.2.1 (SVN Rev 29141)

Copyright 1998-2009 Gerald Combs <gerald () wireshark org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.20.3, with WinPcap (version unknown), with libz 1.2.3,
without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8, with c-ares 1.6.0,
with Lua 5.1, with GnuTLS 2.8.1, with Gcrypt 1.4.4, with MIT Kerberos, with
GeoIP.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1 beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS 2.8.1,
Gcrypt 1.4.4.

Built using Microsoft Visual C++ 9.0 build 30729

$ tshark -r VoIP_Communicator_Snippet.pcap -d"udp.port==50056,rtp" -qz rtp,streams
========================= RTP Streams ========================
    Src IP addr  Port    Dest IP addr  Port       SSRC          Payload  Pkts         Lost   Max Delta(ms)  Max 
Jitter(ms) Mean Jitter(ms) Problems?
  102.1.145.163 50056  244.55.112.179 50048 0xABBCE50F     Unknown(118)     1     0 (0.0%)            0.00            
0.00         0.00
 244.55.112.179 50048   102.1.145.163 50056 0x726E7E61     Unknown(118)    40     0 (0.0%)            0.00            
0.00         0.00
==============================================================


-- 
-jp

Do you know what happens when you slice a golf ball in half? Someone gets mad at you. I found this out the hard way. 

deepthoughtsbyjackhandey.com


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe