- Subject: Re: [Ethereal-dev] Ethereal addition for analysing RTP data
- From: Miha Jemec <m.jemec@xxxxxxxxxxx>
- Date: Fri, 07 Mar 2003 10:12:05 +0100
Hi !
I found a sample that causes me problem using the tap system.
It is the second packet in attached file, which is actually an ICMP port
unreacheable message to the previous RTP packet. The ICMP was sent
because the port was closed and it contains some bytes from the previos
packet: IP header, UDP header, RTP header and 24 bytes from RTP data.
The problem is, that this packet seems to be handled as RTP even it is a
plain ICMP message. So I get the tap event for it and it even passes the
RTP display filter.
Since this is not a RTP packet but an ICMP packet with the information
which packet caused this error (in our case previous RTP packet) I think
that it shouldn't be passed to the tap listener for rtp packets and
should be filtered out by RTP display filter.
Miha.
Attachment:
icmp_rtp.raw
Description: Binary data
