Changing RTP Playback In Wireshark
08/07/2024In Wireshark's RTP Player, there is an option for "Playback Timing".
Thee options provided are:
- Jitter Buffer
- RTP Timestamp
- Uninterrupted Mode
These options can have a significant effect on the playback of a capture RTP stream dependant on the quality of the recording.
For example, if the capture was made on a very noisy network/NIC, then a large amount of Jitter can occur.
This means that the RTP packets received can come into Wireshark at an inconsistent rate for the audio. What I mean is on a good network, you will receive the RTP packets at a consistent rate, on a noisy network, you will get a lot of other packets getting in the way.
Therefore if the RTP timestamps are used as indication of the time that the audio was recorded, it means the audio will sound "stuttery" or "Jittery".
So to help see that, the RTP Player in Wireshark has different ways to playback the audio stream.
Jitter Buffer - Uses the Jitter calculations to remove any silence caused by jitter when receiving the audio packets.
RTP Timestamp - Plays the audio back in at the time it was received based on the timestamp in the packets, injecting silence if packets were delayed.
Uninterrupted Mode - All gaps are ignored, so no silence is inserted, just the audio "as recorded" is played, skipping any jitter, silence etc.
If you want to know how Jitter is calculated, this is a simple overview: https://wiki.wireshark.org/RTP_statistics#how-jitter-is-calculated
So Jitter Buffer is going to give you closest to what you would expect from a VoIP call recording. RTP Timestamp will give you the audio as it was received by Wireshark, and Uninterrupted Mode will give you just the audio it recorded with no intelligent silence injected.
Thank you for your time.
If you want to reach out, catch me on Twitter!