NAME

rtpdump — parse and print RTP packets

SYNOPSIS

DESCRIPTION

rtpdump reads RTP and RTCP packets on the given address/port, or from standard input by default, and dumps a processed version to standard output. The output is suitable as input for rtpplay(1) and rtpsend(1). The IPv4 address can be specified in dotted decimal notation or as a hostname and defaults to “localhost”. The port number must be an even number.

The options are as follows:

-F format

Write the output in the given format, which is one of the following: dump, header, payload, ascii, hex, rtcp, short.

The dump format is a binary format suitable as input for rtpplay(1). The generated output file should have a .rtp filename extension. The file starts with

#!rtpplay1.0 address/port\n

The version number indicates the file format version, not the version of RTP tools used to generate the file. The current file format version is 1.0. This is followed by one RD_hdr_t header and one RD_packet_t structure for each received packet. All fields are stored in the network byte order. This metadata is followed by the actual RTP or RTCP packet, recorded as-is. The structures are as follows:

typedef struct {
  struct timeval start;  /* start of recording (GMT) */
  uint32_t source;       /* network source (multicast) */
  uint16_t port;         /* UDP port */
} RD_hdr_t;

typedef struct {
  uint16_t length; /* length of original packet, including header */
  uint16_t plen;   /* actual header+payload length for RTP, 0 for RTCP */
  uint32_t offset; /* ms since the start of recording */
} RD_packet_t;

The header format is like dump, but does not save the audio/video payload. The payload format only saves the audio/video payload.

The ascii format, which is the default, saves text parsed packets, suitable for rtpsend(1). Each entry starts with a time value, in seconds, relative to the beginning. The time value appears at the beginning of a line, without white space. Within an RTP or RTCP packet description, parameters may appear in any order, without white space around the equal sign. Lines are continued with initial white space on the next line. Comment lines start with ‘#’. Strings are enclosed in quotation marks. The actual RTP and RTCP entries look like this:

<time> RTP
	v=<version>
	p=<padding>
	x=<extension>
	m=<marker>
	pt=<payload type>
	ts=<time stamp>
	seq=<sequence number>
	ssrc=<SSRC>
	cc=<CSRC count>
	csrc=<CSRC>
	data=<hex payload>
	ext_type=<type of extension>
	ext_len=<length of extension header>
	ext_data=<hex extension data>
	len=<packet size in bytes (including header)>

<time> RTCP
	(SDES v=<version> (src=<source> cname="..." name="...") (...))
	(SR v=<version>
		ssrc=<SSRC of data source>
		p=<padding>
		count=<number of sources>
		len=<length>
		ntp=<NTP timestamp>
		psent=<packet sent>
		osent=<octets sent>
		(ssrc=<SSRC of source>
			fraction=<loss fraction>
			lost=<number lost>
			last_seq=<last sequence number>
			jit=<jitter>
			lsr=<last SR received>
			dlsr=<delay since last SR>
		)
	)

The hex format is like ascii, but with a hex dump of the payload. The rtcp format is like ascii, but only saves RTCP packets.

The short format dumps RTP or VAT data in lines such as

[-]time timestamp [seq]

where ‘-’ indicates a set marker bit, time is the arrival time, timestamp is the RTP timestamp, and seq is the RTP sequence number (only used for RTP packets).

-f infile

Read packets from infile instead of the network or standard input. The file must have been recorded using the dump format.

-h

Print a short usage summary and exit.

-o outfile

Dump to outfile instead of to standard output.

-t minutes

Only listen for the first minutes.

-x bytes

Process only the first number of bytes of each packet's payload. This is only applicable for the dump and hex formats.

EXAMPLES

$ rtpdump -F ascii < bark.rtp
44.020000 RTP len=172 from=0.0.0.0:0 v=2 p=0 x=0 cc=0 m=1 pt=0 (PCMU,1,8000) seq=54553 ts=3988999488 ssrc=0x59c72
44.030000 RTCP len=72 from=0.0.0.0:0
 (SR ssrc=0x59c72 p=0 count=0 len=6
  ntp=3167928311.3622222025 ts=3988999508 psent=1 osent=160
 )
 (SDES p=0 count=1 len=10
  (src=0x59c72 CNAME="good_dog@columbia.edu" NAME="nice_dog" )
 )
44.050000 RTP len=172 from=0.0.0.0:0 v=2 p=0 x=0 cc=0 m=0 pt=0 (PCMU,1,8000) seq=54554 ts=3988999648 ssrc=0x59c72
44.070000 RTP len=172 from=0.0.0.0:0 v=2 p=0 x=0 cc=0 m=0 pt=0 (PCMU,1,8000) seq=54555 ts=3988999808 ssrc=0x59c72
[...]
44.380000 RTP len=173 from=0.0.0.0:0 v=2 p=0 x=0 cc=0 m=0 pt=0 (PCMU,1,8000) seq=54567 ts=3989001728 ssrc=0x59c72

$ rtpdump -F rtcp /1234
1529922419.410173 RTCP len=72 from=127.0.0.1:38874
 (SR ssrc=0x59c72 p=0 count=0 len=6
  ntp=3167928311.3622222025 ts=3988999508 psent=1 osent=160
 )
 (SDES p=0 count=1 len=10
  (src=0x59c72 CNAME="good_dog@columbia.edu" NAME="nice_dog" )
 )

$ rtpdump -F short /1234
-1511433758.442892 3988999488 54553
1511433758.480881 3988999648 54554
1511433758.500863 3988999808 54555
1511433758.520860 3988999968 54556
1511433758.540872 3989000128 54557

SEE ALSO

rtpplay(1), rtpsend(1)

AUTHORS

rtpdump was written by Henning Schulzrinne <hgs@cs.columbia.edu>, with enhancements by Ping Pan, Akira Tsukamoto <akira.tsukamoto@gmail.com>, Jan Stary <hans@stare.cz>, and Jan Janak <janakj@cs.columbia.edu>.