Wireshark · Wireshark-users: Re: [Wireshark-users] packet loss and network issues - wireshark

[Raghul Prasanna <raghul82@xxxxxxxxxxx>]

Thanks Lars,

>>Yes, the packet loss count is based on the RTP sequence number.

Basically, packet loss counter is increased by (SEQ_N - SEQ_N-1 - 1), where N and N-1 are the currently and previously received RTP packets of that same tream, respectively. This value can be negative.

OK this is in received direction, what about in Transmit direction please?

Raghul

---

From: "RUOFF, LARS (LARS)** CTR **" <lars.ruoff@xxxxxxxxxxxxxxxxxx>
To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
Sent: Monday, 5 December 2011, 10:11
Subject: Re: [Wireshark-users] packet loss and network issues - wireshark


Hi,

> But what I am failing to understand is where is wireshark getting the sequence number, because UDP doesnt have any sequence number, then is it the RTP packet number?

Yes, the packet loss count is based on the RTP sequence number.
Basically, packet loss counter is increased by (SEQ_N - SEQ_N-1 - 1), where N and N-1 are the currently and previously received RTP packets of that same tream, respectively. This value can be negative.

> MAX Delta - Is this max gap between packets for a stream? If so what will be the best value?

Yes.
If there's no silence suppression, the expected value is the "framing" used for that call and codec.
Typical values are 20ms or 30ms for G.711 for example.
More precisely, the expected value is the difference between RTP timestamps, taking into account the Codec sampling rate, and expressed in miliseconds. This is usually constant throughout a call.

Care must be taken if the stream contains silence frames, comfort noise, etc.
Wireshark doesn't handle them too well in the jitter or loss calculations and you might get unexpected results.

Lars


________________________________

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Raghul Prasanna
Sent: dimanche 4 décembre 2011 15:49
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] packet loss and network issues - wireshark


Hello,

Sorry if its a simple question, I am bit new to wireshark.

I am trying to find out network issues, because the audio quality is bad during peak hours. When I capture on an interface and do stream analysis of RTP stream I see some streams showing more than 70% packet loss.

When I capture on an inteface I believe the wireshark captures audio in both the directions and I believe wireshark detects packet loss based on transport layer protocol, in my case UDP.

Strem analysis of one such stream shows lots of wrong sequence number, which would again indicate packet loss. But what I am failing to understand is where is wireshark getting the sequence number, because UDP doesnt have any sequence number, then is it the RTP packet number?

How would wireshark know packet loss in TX direction based on packet loss, because I see packet loss for streams going from my interface to the far end?

MAX Delta - Is this max gap between packets for a stream? If so what will be the best value?

Thanks,
Raghul
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe