wireshark 怎么使用

[归途醉染]

大家好! 我想问一下wireshark 怎么抓取udp中的rtp包,在网上一通搜索,发现都是和我机子的wireshark 不一样?






实在不知道怎么抓取到rtp包,我使用的环境为win10,wireshark 版本为3.0.0

感谢各位大佬解答!!!

[归途醉染]

没人 我顶.

[归途醉染]

csdn 里人越来越多逃离了...

[归途醉染]

没人

引用 4 楼 ipqtjmqj 的回复:

This from the Wireshark wiki In most cases RTP port numbers are dynamically assigned. You can use something like the following which limits the capture to UDP, even source and destination ports, a valid RTP version, and small packets. It will capture any non-RTP traffic that happens to match the filter (such as DNS) but it will capture all RTP packets in many environments. udp[1] & 1 != 1 && udp[3] & 1 != 1 && udp[8] & 0x80 == 0x80 && length < 250 So you could negate the filter to capture all but. 来源https://community.spiceworks.com/topic/2007593-wireshark-rtp-capture-filter

谢谢

[老雍]

先通过ip和端口过滤非rtp流，如果显示udp，解码成rtp协议就可以看到

[ipqtjmqj]

This from the Wireshark wiki In most cases RTP port numbers are dynamically assigned. You can use something like the following which limits the capture to UDP, even source and destination ports, a valid RTP version, and small packets. It will capture any non-RTP traffic that happens to match the filter (such as DNS) but it will capture all RTP packets in many environments. udp[1] & 1 != 1 && udp[3] & 1 != 1 && udp[8] & 0x80 == 0x80 && length < 250 So you could negate the filter to capture all but. 来源https://community.spiceworks.com/topic/2007593-wireshark-rtp-capture-filter

[西山猎人]

在菜单里面有一个选项，可以把RTP流量单独显示出来。

[归途醉染]

引用 7 楼 西山猎人 的回复:

在菜单里面有一个选项，可以把RTP流量单独显示出来。

哪里有个菜单?

[谭林峰]

应该是wireshark 没有解析出来，你先过滤udp，找到大量连续的udp包（比如源地址源端口大量往同一ip地址和端口发数据）。打开数据包（打开图二的那种），在”当前”菜单栏选择协议rtp

[happybeginner]

首先你要确定要解析的确定是rtp包
然后用decoded as功能将他重新应用一下就好了