Re: OT: RTP Stream Analysis and Reporting

Hi Adam,

Thanks! I agree with you that the Lua tutorial data is limited. I
have looked at it a couple of times and it has always scared me
away. ;-) And unfortunately, the summary data I posted below isn't
directly available in the trace files; rather, it's the product of
Wireshark analysis of the trace files in question. I like that
Wireshark is willing to walk through the RTP sequence numbers and
report back to me whether or not there have been any missing or
unordered datagrams. What I don't like is that Wireshark is only
willing to display that to me in a popup. The conspiracy theorist in
me suspects that Riverbed (which acquired Cace Tech) is
commercializing Wireshark and any advanced features (e.g. RTP graphing/
reporting) will require that you purchase a license to a bolt-on
product such as Pilot. And in this case I'd be willing to play along
if only Pilot had RTP support, which from what I can tell it does not.

Thanks to all for your suggestions - I'm looking at asking my client
to fork over the big bucks for OmniPeek Enterprise as the leading
contender right now...

Scott

On Apr 20, 2011, at 3:45 , Adam Booth wrote:

> Hi Scott,
>
> I would suggest that you need to see if you can obtain this data via
> the built in scripting capability using Lua - http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html
> I have to warn you that there isn't a great deal of tutorial data
> available but it may be handy. Alternatively in the past I have had
> to do a two step process with exporting the packet dump from
> wireshark to a plain text file and then parsing it with a script to
> pull the relevant data of interest together to create a report.
> This can be helpful if you want to do a packet analysis but don't
> want to have to do reassembly yourself.
>
> Cheers,
> Adam
>
>
> On Thu, Apr 21, 2011 at 4:00 AM, Scott M Vermillion <scott_at_it-
> ag.com> wrote:
> All:
>
> I have recently captured quite a large volume of RTP traffic using
> Wireshark and am searching for a way to generate some decent
> reporting against the trace files. Wireshark itself allows for some
> analysis via:
>
> Telephony->RTP->Stream Analysis
>
> However, other than saving the raw line-by-line statistics to a .csv
> file, there doesn't appear to be any rich reporting capability. In
> the analysis window, I see summary information as follows:
>
> Max delta = 16.75 ms at packet no. 328593
> Max jitter = 0.66 ms. Mean jitter = 0.12 ms.
> Max skew = -6.45 ms.
> Total RTP packets = 404234 (expected 404234) Lost RTP packets =
> 0 (0.00%) Sequence errors = 0
> Duration 600.00 s (-5 ms clock drift, corresponding to 89999 Hz
> (-0.00%)
>
> None of this is exported to the .csv file. My goal is to provide a
> client with a succinct report of these captured RTP streams (MPEG-
> II). In particular "Lost RTP packets" and "Sequence errors" are of
> interest. I evaluated Cascade Pilot from Cace Tech but they seem
> slanted towards TCP in their reporting capabilities. Anybody know
> of a trick in Wireshark or some other product that I can leverage
> for this purpose (short of doing a bunch of screen capture)?
>
> Thanks much,
>
> Scott
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Thu Apr 21 2011 - 10:26:59 ART