Send RTP packet with scapy and see it in a cap
I have this code to write a RTP packet in a cap:
client = "192.168.10.1"
server = "192.168.10.5"
client_port = 5061
server_port = 5060
rtp = {
"sequence": 1,
"timestamp": 1,
"marker": 1,
"payload_type": 17
}
pkt= Ether()/IP(src=client, dst=server)/UDP(sport=client_port, dport=server_port)/RTP(**rtp)
wrpcap("rtp_pkt.pcap",pkt)
The problem is that I see the packet as UDP in wireshark and not RTP. I can see it with SIP structures so I don't know where is the problem,
Solution 1:
In short - Wireshark shows you UDP, because there's no SIP/SDP packets. These packets initiate connection session and Wireshark then can follow the stream and decode UDP to RTP. In SIP/SDP you can find main information: From, To, Media type etc. (RFC 4566 SDP, RFC3621 SIP). So even if you build ideal RTP packet with scapy, without session initiation Wireshark will always decode it as UDP.
EDIT: By the way, use bind_layers(UDP, RTP, dport=*) in scapy to bind UDP packets with RTP, might help