Wireshark-users: Re: [Wireshark-users] Requesting command to decode UDP packet to RTP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 6 Apr 2017 13:23:22 -0700
On Apr 6, 2017, at 1:04 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:

> ... but isn't it always the same story; "how to get UDP dissected as RTP"? I
> can't remember the question being asked the other way around....

Enabling the heuristic solves two problems: "how to get UDP traffic that's RTP traffic dissected as RTP" and "how to get UDP traffic that's *not* RTP traffic *mis*dissected as RTP". :-)  It's a *very* weak heuristic, and could get a lot of non-RTP traffic misdissected as RTP.

Therefore, you might not want to permanently turn the heuristic dissector on - you might want to turn it on for some captures but leave it off for others.