Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Can we have two simultaneous udp streams between 2 specific pairs of IPs and Ports?

I'm trying to inspect and analyze my network traffic. Suddenly I found something confusing. I was thought that packets are splited to streams based on their (SRC_IP, DES_IP, SRC_PORT, SRC_PORT , PROTOCOL_NUM). But now I found two groups of packets with equal above features but interpreted as two different streams in Wireshark:

As you see below, the RTP packets with even packet numbers are a single stream and the RTP packets with odd packet number are another stream, while both has equal (SRC_IP, DES_IP, SRC_PORT, SRC_PORT , PROTOCOL_NUM). Why?

To compare the statistics:

enter image description here

enter image description here

They are interpreted as two different streams:

enter image description here

enter image description here

like image 363
Ebrahim Ghasemi Avatar asked Aug 25 '16 06:08

Ebrahim Ghasemi


1 Answers

You are just looking at the UDP traffic from either direction. UDP stream 2 is from 192.168.1.162 to 192.168.1.159 and UDP stream 3 is from 192.168.1.159 to 192.168.1.162.

While there are two UDP streams, there is only one RTP session. This is because the RFC protocol states that you cannot multiplex on the same port. From RTP RFC Section 5.2.

In RTP, multiplexing is provided by the destination transport address
(network address and port number) which is different for each RTP session.

So, yes there are two simultaneous UDP streams, but it is just both hosts talking to each other during a RTP session.

like image 174
Liam Kelly Avatar answered Oct 17 '22 22:10

Liam Kelly