I've tested the same thing with SnifferPro and they seem to be able to identify RTP/RTCP frames without access to frames from a signalling protocol. I tested this by capturing a few RTP frames and opening the capture with only RTP frames in sniffer pro. It was able to identify the frames as RTP. So my question is: Does anyone know how they might be able to do this other than by a brute force method?
Anand At 10:55 AM 7/24/2002 -0700, Guy Harris wrote:
On Wed, Jul 24, 2002 at 12:03:55PM +0300, cpetrut wrote: > A few weeks ago I starting to develop plugins for Ethereal, and now I > have problems with protocols implementation. > > I want to automaticaly decode RTP and RTCP, for a range of ports. > (not using "Decode as..." option)
"Automatically" in what sense?
I.e., where do you find out the range of ports?
If there's some other protocol that has messages indicating that certain ports are used for RTP and RTCP - RTSP, for example - and RTP and RTCP will be running over UDP, for example, then you'd do it the same way the RTSP dissector does it, i.e. you'd construct a "conversation", given the IP addresses of the hosts that will be exchanging RTP and RTCP messages, and the port numbers being used, and specify that the RTP and RTCP dissectors should be used for that conversation. _______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
-- Anand V. Narwani, CCIE 3892 Advanced Engineering Services Cisco Systems, Inc. Direct/Fax: 919.392.3404 Email: [EMAIL PROTECTED]
"Meddle not in the affairs of dragons, for you are crunchy and taste good with ketchup"
