wireshark利用RTP包分析相邻时间戳差值

利用wireshark对rtsp流进行抓包后，有时候可能需要分析音视频延时的时候，可能会分析RTP包的相邻时间戳。

RTP timestamp

时间戳 记录了负载中第一个字节的采样时间，接收方根据时间戳能够确定数据的到达是否受到了延迟抖动的影响.

RTP timestamp: RTP timestamp is based on the sampling frequency of the codec, 8000 in most audio codecs and 90000 in most video codecs.
As the sampling frequency must be known to correctly calculate jitter it is problematic to do jitter calculations for dynamic payload types as the codec and it's sampling frequency must be known which implies that the setup information for the session must be in the trace and the codec used must be known to the program(with the current implementation).

计算时间戳差值步骤

下面以视频为例进行分析:

• 获取时钟信息.
  从DESCRIBE的响应报文中的SDP信息中获取时钟信息.

过滤RTSP 然后找到时钟信息

Media Attribute (a): rtpmap:96 H264/90000

H264/90000中的90000说明将1秒分成90000份，即90份为1ms.
如果是40ms的话，应该为3600份.

• 查看相邻时间戳的差值.

利用rtp包分析时间戳差值 时间戳举例

可以看到有些RTP包的时间戳是相同的，说明这些RTP属于同一帧.
相邻时间戳差值，举例如下:

1036954710 - 1036951110 = 3600

表明相邻时间戳的间隔为40ms.

References

https://wiki.wireshark.org/RTP_statistics
http://blog.csdn.net/acs713/article/details/19339707