Real-time Transport Protocol (RTP) in Wireshark

Real-time Transport Protocol (RTP) is a network protocol that provides real-time audio and video communications, such as voice and video chat, over computer networks. This protocol works on top of the Transmission Control Protocol (TCP). Wireshark is a cross-platform packet analyzer used for troubleshooting and analyzing data packets traversing the network (in particular in order to capture or follow streams of digital data). It’s used by hundreds of thousands of organizations to implement IT security, network monitoring, development testing and curriculum.

The following section discusses how the RTP protocol is used by Wireshark. We will see how Wireshark can decode and view the protocol data on a network interface. The final section of this article will discuss configuring Wireshark to capture and decode RTP-based traffic. We will use a sample scenario to discuss the RTP communication process between two endpoints, that is participant A (sender) and participant B (receiver). The communication between the two participants is based on the Multicast RTP protocol which is a reliable protocol.

Let’s capture an RTP packet from participant A which contains a streaming video file. 

• Under the Wireshark menu, select Statistics | General Packet The general packet statistics window shows the fields and their respective values for a particular packet. For example, for an RTP data stream, we have the transport protocol (RTP) and media type (audio/video). 
• You will also see the time offset of current time in milliseconds and the byte count of all packets transmitted. 
• Let’s now send an audio file to participant B. Once we capture an audio file, we will see that there is an incoming UDP/IP protocol traffic that is being captured as part of this pcap file.
• Now, let’s look at the same general packet statistics window for this specific packet that we are interested in. If you scroll down to the bottom of the window, you will see that the RTP protocol is being used by both participants. 
• To decode and view more information about RTP communication, we need to do a deep analysis of packets involved in an RTP session. 
• We will use the same sample audio file which was sent to participant B. As part of this task, we will also explore how Wireshark decodes and views RTP-based traffic on a network interface.

RTP stands for Real-Time Protocol, which is a protocol that allows the transmission of streaming media over an IP-based network. The protocol determines how audio and video data will be encoded, transmitted, and packaged in data packets along with the information necessary to decode the data at its destination. The communication endpoints involved in an RTP session are called participants. The two participants in an RTP session are called the RTP sender and the RTP receiver.