How do I decode a RTP packet?


  1. On the Wireshark packet list, right mouse click on one of UDP packet.
  2. Select Decode As menu.
  3. On the Decode As window, select Transport menu on the top.
  4. Select Both on the middle of UDP port(s) as section.
  5. On the right protocol list, select RTP in order to the selected session to be decoded as RTP.

What is RTP packet?

RTP – short for Real-time Transport Protocol defines a standard packet format for delivering audio and video over the Internet. While RTP carries the media streams (e.g., audio and video), RTCP is used to monitor transmission statistics and quality of service (QoS) and aids synchronization of multiple streams.

What is RTP packet size?

The RTP header has a minimum size of 12 bytes. After the header, optional header extensions may be present. This is followed by the RTP payload, the format of which is determined by the particular class of application.

Can RTP run over TCP?

RTP applications can use the Transmission Control Protocol (TCP), but most use the User Datagram protocol (UDP) instead because UDP allows for faster delivery of data.

How do I tell the difference between RTP and RTCP?

RTP does the delivery of the actual data, whereas RTCP is used to send control packets to participants in a call. The primary function is to provide feedback on the quality of service being provided by RTP.

How do I analyze RTP stream in Wireshark?

RTP stream analysis

  1. use the menu entry Statistics(Wireshark 1.0) or Telephony >> RTP >> Show All Streams… and select a stream in the upcoming “RTP Streams” dialog.
  2. select an RTP packet in the Packet List Pane and use Statistics(Wireshark 1.0) or Telephony >> RTP >> Stream Analysis…

How do I use RTP stream in Wireshark?

Wireshark can be used for RTP stream analysis….

  1. Open Telephony → RTP → RTP Streams window, it will show all streams in the capture.
  2. Select any RTP packet in packet list, open Telephony → RTP → Stream Analysis window.
  3. Open Telephony → VoIP Calls or Telephony → SIP Flows window, it will show all calls.

Does RTP guarantee packet delivery?

The sequence numbers included in RTP allow the receiver to reconstruct the sender’s packet sequence and to detect packet loss. However, RTP itself does not provide any mechanism to ensure timely delivery of data and does not guarantee quality-of-service (QoS) for real-time services.

How many bytes is a VoIP packet?

All VoIP packets are made up of two components: voice samples and IP/UDP/RTP headers. Although the voice samples are compressed by the Digital Signal Processor (DSP) and can vary in size based on the codec used, these headers are a constant 40 bytes in length.

What layer is RTP in the OSI?

In the context of the OSI Reference Model, RTP falls into both the Session Layer (Layer 5) and the Presentation Layer (Layer 6). RTP Control Protocol (RTCP) is an upper-layer companion protocol that allows monitoring of the data delivery.

How are sequence numbers used in RTP protocols?

The sequence number increments by one for each RTP packet sent, and may be used by the receiver to detect packet loss and to restore packet sequence. For example, if the receiver side of the application receives a stream of RTP packets with a gap between sequence numbers 86 and 89, then the receiver knows that packets 87 and 88 were lost.

How does real time Transport Protocol ( RTP ) work?

Real-time Transport Protocol (RTP) runs on top of UDP. Specifically, audio or video chunks of data, generated by the sending side of a multimedia application, are encapsulated in RTP packets, and each RTP packet is in turn encapsulated in a UDP segment.

How to decipher the RTP stream for packet loss analysis?

The packet captures are taken on the Central and Branch WAN router and the WAN drops these packets. Focus on the RTP stream from central IP phone ( to branch IP phone ( This stream misses packets on the branch WAN router if the WAN drops the packets on the stream from central WAN router to branch WAN router.

How are RTP packets distributed in a session?

RTCP packets are transmitted by each participant in an RTP session to all other participants in the session. The RTCP packets are distributed to all the participants using IP multicast. For an RTP session, typically there is a single multicast address, and all RTP and RTCP packets belonging to the session use the multicast address.