Ethereal-users: Re: [Ethereal-users] FW: RTP playback using ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Harsh, Brent" <cnc291@xxxxxxxxxxxxxxxxxx>
Date: Mon, 28 Jun 2004 08:55:40 -0400
Tamar Nemet and Matt Adams asked:

I captured RTP packets with the ethereal tool on my PC. How can I hear the RTP stream using the ethreal or any other tool?

>How do I filter and save the voice payload so that a media player can play the >message back?

We don't usually filter because the RTP analysis part is used to select which port you're going to hear, so just capture everything. Once the file is captured, select one RTP packet from either UDP (ie, RTP) port used by your call. From the Analyze menu, select "Decode As". In this dialog box, make sure "decode" is ticked. Choose "both" from the UDP ports menu. Select RTP from the list of protocols.

Now, from Statistics menu select "RTP" and then "Stream Analysis." Click on "Save Payload", and in that dialog box make sure "both" is checked, then give it a filename and save it away. This creates a .au type of file.

We use CoolEdit to see the waveform and do spectral analysis on the audio file, but I think it plays in some default Windows player as well.

If anyone knows a better way, please post...

Now, a question for the group: when using a payload type that doesn't conform to one of the known values (ie, 0 for G711ulaw, 8 for G711alaw, or 18 for G729 etc...) ethereal will not decode the stream. We use a negotiated value for a clear-channel data stream and in order to hear it, I use a perl script (or a regexp in xemacs in binary mode!) to replace the payload type byte in all the RTP packets with a 00. This works fine, but it would be nice if ethereal had a way to specify the pt used for x-ccd (or even if you just wanted to "force" it to decode anyway). I just started using ethereal, so am not terribly familiar with it yet - perhaps this functionality is in there somewhere already?

--
Brent Harsh - KD4PBO     /"\  ASCII Ribbon Campaign: Say
cnc291@xxxxxxxxxxxxxxxxxx\ / NO to HTML in email and news.
--------------------------X-------------------------------
Nortel Networks, RTP, NC / \     Not Nortel's Opinions.