How Cisco detects RTP packages?

[hofo123456]

hello my friends

How Cisco detects RTP packages?

RTP pachet What is header that can detect?

RTP  Are UDP alone !

Even in Wireshark not detected !!! only UDP view in wireshark 

[Charles Hill]

Hello hossein,

Cisco uses port numbers to communicate, depending on the protocol.

RTP is UDP only. 

RTP = 16384 - 32767 

SCCP(skinny)  = tcp 2000 - 2002 

Link below lists tcp and udp ports usage by Callmanager.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/port/8_6_1/portlist861.html

To detect and capture a specific type of traffic, filter by ports in wireshark depending on the interesting traffic you are trying to capture

Not sure if I have answered your question, but hopefully this will help.

Please rate helpful posts.

Thanks.

Charles 

[hofo123456]

tanks friends

The only Cisco uses this range? (RTP = 16384 - 32767)
Or a law global ?

Thanks.

[Charles Hill]

Rtp ports may be used by any vendor.  Rfc 3550 defines the RTP ports as an industry standard.

Hope this helps.

[Terry Cheema]

Apart from the port information as described by Charles (+5), you should be identify the RTP traffic in wireshark. If you want to just see the RTP - set the filter to "rtp". See below a screen shot of wireshark capture:

-Terry

Please rate all helpful posts
 

[hofo123456]

I found the correct answer ...

Rtp packets of bits are identified and NOT be  determine the port numbers UDP !

if first bit number 8  (1 0 0 0) , then packet = RTP !

you can generate packet and see by software HEX editor ;)

Good luck friends ....