Re: [Ethereal-users] how does ethereal determine whether RTP or not?

[Guy Harris <guy@xxxxxxxxxxxx>]

On Thursday, September 4, 2003, at 4:56 AM, darren wrote:

> I did some capture of a Video stream with ethereal on my own
> computer...after which ethereal correctly identified the UDP packets as
> being RTP.
>
> After I did a filter on all the RTP packets (filter RTP) and save the
> filtered packets in a separate file, I reopened the file in another 
> ethereal
> session...but this time...it was identified as simply UDP...

The packets you filtered out probably contained H.245 or RTSP traffic 
that specified that RTP would be used in future UDP traffic between 
particular IP addresses and ports; without that traffic, Ethereal 
doesn't know that the random UDP ports in question happen to be 
carrying RTP traffic.