Send RTP packet with scapy and see it in a cap

I have this code to write a RTP packet in a cap:

client = "192.168.10.1"
server = "192.168.10.5"
client_port = 5061
server_port = 5060


rtp = { 
        "sequence": 1,
        "timestamp": 1,
        "marker": 1,
        "payload_type": 17
    }

pkt= Ether()/IP(src=client, dst=server)/UDP(sport=client_port, dport=server_port)/RTP(**rtp)

wrpcap("rtp_pkt.pcap",pkt)

The problem is that I see the packet as UDP in wireshark and not RTP. I can see it with SIP structures so I don't know where is the problem,


Solution 1:

In short - Wireshark shows you UDP, because there's no SIP/SDP packets. These packets initiate connection session and Wireshark then can follow the stream and decode UDP to RTP. In SIP/SDP you can find main information: From, To, Media type etc. (RFC 4566 SDP, RFC3621 SIP). So even if you build ideal RTP packet with scapy, without session initiation Wireshark will always decode it as UDP.

EDIT: By the way, use bind_layers(UDP, RTP, dport=*) in scapy to bind UDP packets with RTP, might help