Two level MPLS

August 8, 2011 0 Comments

Multiprotocol Label Switching (MPLS) is a mechanism in high-performance telecommunications networks which directs and carries data from one network node to the next with the help of labels. MPLS makes it easy to create “virtual links” between distant nodes. Below sample packets  show us some typical network traffics but with dual MPLS label inside of [...]

Read more
Networking
, ,

Frame Relay

August 5, 2011 0 Comments

Frame Relay is a protocol standard for LAN internetworking which provides a fast and efficient method of transmitting information from a user device to LAN bridges and routers.   frame relay has a layer 2 encapsulation which is below than normal IP traffic. We can look into the protocol layers by a sample packet  

Read more
Links, Networking
, ,

Spanning Tree Protocol

August 1, 2011 1 Comment

here it is a STP (spanning tree protocol) packet, I am not building a wiki page for this protocol, I just want to show you the real packet. On wikipedia, the STP is describe as Full wiki info http://en.wikipedia.org/wiki/Spanning_Tree_Protocol

Read more
Networking
,

Myth behind Apple iTunes and AirPlay

August 8, 2011 2 Comments

As you may know, Apple announced AirPlay which allow iTunes and iPhone/iPad to connect to a remote display to show media. Actually, few years ago, apple already implemented similar technology into AirPort express to play music from a remote iTunes. How this technology implemented? There are few documents really describe this very well, it may named as DACP or RAOP or something. Let’s discover it a little bit through some actual packets regarding an iTunes playing an MP3 song though a Airport Express audio link.

Below is the packets (hided some packets for easier reading). In the beginning, iTunes discovered existence of an AirPort express smartly through a bundle of MDNS (Multicast DNS) packets  over udp port 5353. Then, a TCP connection to 5000 port of AirPort Express was established and the actual communication is very similar to RTSP.

No. Source Destination Protocol Info Time
1 172.16.0.20 224.0.0.251 MDNS
Standard query PTR _appletv-pair._tcp.local, "QU" question
 0.000000
2 172.16.0.20 224.0.0.251 MDNS
Standard query PTR _appletv._tcp.local, "QU" question PTR _00000000-0d0e-fa7f-0b50-36529f4c4484._sub._home-sharing._tcp.local, "QU" question
 0.112834
3 172.16.0.20 224.0.0.251 MDNS
Standard query PTR _daap._tcp.local, "QU" question
 0.221835
4 172.16.0.20 224.0.0.251 MDNS
Standard query PTR _touch-remote._tcp.local, "QU" question PTR _raop._tcp.local, "QU" question
 0.325505
5 172.16.0.20 224.0.0.251 MDNS
Standard query ANY BE884DCD459CF5D3._touch-able._tcp.local, "QU" question ANY \342\200\234vader.yang\342\200\235 \347\232\204\350\265\204\346\226\231\345\272\223._home-sharing._tcp.local, "QU" question
 0.437854
6 172.16.0.20 224.0.0.251 MDNS
Standard query ANY BE884DCD459CF5D3._touch-able._tcp.local, "QM" question ANY \342\200\234vader.yang\342\200\235 \347\232\204\350\265\204\346\226\231\345\272\223._home-sharing._tcp.local, "QM" question
 0.690539
7 172.16.0.25 224.0.0.251 MDNS
Standard query response PTR 001451729FE1@Vader's AirPort Express._raop._tcp.local
 0.729771
30 172.16.0.20 172.16.0.25 TCP
56591 > 5000 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8
 29.067052
31 172.16.0.25 172.16.0.20 TCP
5000 > 56591 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 WS=0
 29.068229
32 172.16.0.20 172.16.0.25 TCP
56591 > 5000 [ACK] Seq=1 Ack=1 Win=17408 Len=0
 29.068295
33 172.16.0.20 172.16.0.25 RTSP
OPTIONS * RTSP/1.0
 29.078157
36 172.16.0.25 172.16.0.20 RTSP
Reply: RTSP/1.0 200 OK
 30.421267
58 172.16.0.20 172.16.0.25 RTSP/SDP
ANNOUNCE rtsp://172.16.0.20/3339622657 RTSP/1.0, with session description
 54.150624
64 172.16.0.25 172.16.0.20 RTSP
Reply: RTSP/1.0 200 OK
 55.497436
65 172.16.0.20 172.16.0.25 RTSP
SETUP rtsp://172.16.0.20/3339622657 RTSP/1.0
 55.497595
66 172.16.0.25 172.16.0.20 RTSP
Reply: RTSP/1.0 200 OK
 55.517123
67 172.16.0.20 172.16.0.25 RTSP
RECORD rtsp://172.16.0.20/3339622657 RTSP/1.0
 55.517452
74 172.16.0.25 172.16.0.20 RTSP
Reply: RTSP/1.0 200 OK
 55.526122
75 172.16.0.20 172.16.0.25 RTSP
SET_PARAMETER rtsp://172.16.0.20/3339622657 RTSP/1.0
 55.526212
76 172.16.0.25 172.16.0.20 RTSP
Reply: RTSP/1.0 200 OK
 55.532051

we can look into a SETUP request in RTSP sequence to see further info exchanged.

  • Frame 65 (355 bytes on wire, 355 bytes captured)
    • Arrival Time: Oct 29, 2009 00:57:38.815845000
    • Time delta from previous captured frame: 0.000159000 seconds
    • Time delta from previous displayed frame: 0.000159000 seconds
    • Time since reference or first frame: 55.497595000 seconds
    • Frame Number: 65
    • Packet Length: 355 bytes
    • Frame Length: 355 bytes
    • Capture Length: 355 bytes
    • Frame is marked: False
    • Protocols in frame: eth:ip:tcp:rtsp
  • Ethernet II, Src: IntelCor_b9:4c:a5 (00:13:e8:b9:4c:a5), Dst: AppleCom_72:9f:e0 (00:14:51:72:9f:e0)
    • Destination: AppleCom_72:9f:e0 (00:14:51:72:9f:e0)
      • Address: AppleCom_72:9f:e0 (00:14:51:72:9f:e0)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Source: IntelCor_b9:4c:a5 (00:13:e8:b9:4c:a5)
      • Address: IntelCor_b9:4c:a5 (00:13:e8:b9:4c:a5)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Type: IP (0x0800)
  • Internet Protocol, Src: 172.16.0.20 (172.16.0.20), Dst: 172.16.0.25 (172.16.0.25)
    • Version: 4
    • Header length: 20 bytes
    • Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      • 0000 00.. = Differentiated Services Codepoint: Default (0x00)
      • .... ..0. = ECN-Capable Transport (ECT): 0
      • .... ...0 = ECN-CE: 0
    • Total Length: 341
    • Identification: 0x041b (1051)
    • Flags: 0x04 (Don't Fragment)
      • 0... = Reserved bit: Not set
      • .1.. = Don't fragment: Set
      • ..0. = More fragments: Not set
    • Fragment offset: 0
    • Time to live: 2
    • Protocol: TCP (0x06)
    • Header checksum: 0x1b3b [correct]
      • Good: True
      • Bad : False
    • Source: 172.16.0.20 (172.16.0.20)
    • Source or Destination Address: 172.16.0.20 (172.16.0.20)
    • Source Host: 172.16.0.20
    • Source or Destination Host: 172.16.0.20
    • Destination: 172.16.0.25 (172.16.0.25)
    • Source or Destination Address: 172.16.0.25 (172.16.0.25)
    • Destination Host: 172.16.0.25
    • Source or Destination Host: 172.16.0.25
  • Transmission Control Protocol, Src Port: 56594 (56594), Dst Port: commplex-main (5000), Seq: 830, Ack: 72, Len: 301
    • Source port: 56594 (56594)
    • Destination port: commplex-main (5000)
    • Source or Destination Port: 56594
    • Source or Destination Port: 5000
    • TCP Segment Len: 301
    • Sequence number: 830 (relative sequence number)
    • Next sequence number: 1131 (relative sequence number)
    • Acknowledgement number: 72 (relative ack number)
    • Header length: 20 bytes
    • Flags: 0x18 (PSH, ACK)
      • 0... .... = Congestion Window Reduced (CWR): Not set
      • .0.. .... = ECN-Echo: Not set
      • ..0. .... = Urgent: Not set
      • ...1 .... = Acknowledgment: Set
      • .... 1... = Push: Set
      • .... .0.. = Reset: Not set
      • .... ..0. = Syn: Not set
      • .... ...0 = Fin: Not set
    • Window size: 17408 (scaled)
    • Checksum: 0x725d [correct]
      • Good Checksum: True
      • Bad Checksum: False
    • SEQ/ACK analysis
      • This is an ACK to the segment in frame: 64
      • The RTT to ACK the segment was: 0.000159000 seconds
  • Real Time Streaming Protocol
    • Request: SETUP rtsp://172.16.0.20/3339622657 RTSP/1.0\r\n
      • Method: SETUP
      • URL: rtsp://172.16.0.20/3339622657
    • CSeq: 2\r\n
    • Transport: RTP/AVP/UDP;unicast;interleaved=0-1;mode=record;control_port=6001;timing_port=6002
    • User-Agent: iTunes/9.0.1 (Windows; Microsoft Windows 7 Ulti\r\n
    • Client-Instance: 41CD59203C22BB74\r\n
    • DACP-ID: 41CD59203C22BB74\r\n
    • Active-Remote: 866548124\r\n
    • \r\n

and below is the relative response packet

  • Frame 66 (278 bytes on wire, 278 bytes captured)
    • Arrival Time: Oct 29, 2009 00:57:38.835373000
    • Time delta from previous captured frame: 0.019528000 seconds
    • Time delta from previous displayed frame: 0.019528000 seconds
    • Time since reference or first frame: 55.517123000 seconds
    • Frame Number: 66
    • Packet Length: 278 bytes
    • Frame Length: 278 bytes
    • Capture Length: 278 bytes
    • Frame is marked: False
    • Protocols in frame: eth:ip:tcp:rtsp
  • Ethernet II, Src: AppleCom_72:9f:e0 (00:14:51:72:9f:e0), Dst: IntelCor_b9:4c:a5 (00:13:e8:b9:4c:a5)
    • Destination: IntelCor_b9:4c:a5 (00:13:e8:b9:4c:a5)
      • Address: IntelCor_b9:4c:a5 (00:13:e8:b9:4c:a5)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Source: AppleCom_72:9f:e0 (00:14:51:72:9f:e0)
      • Address: AppleCom_72:9f:e0 (00:14:51:72:9f:e0)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Type: IP (0x0800)
  • Internet Protocol, Src: 172.16.0.25 (172.16.0.25), Dst: 172.16.0.20 (172.16.0.20)
    • Version: 4
    • Header length: 20 bytes
    • Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      • 0000 00.. = Differentiated Services Codepoint: Default (0x00)
      • .... ..0. = ECN-Capable Transport (ECT): 0
      • .... ...0 = ECN-CE: 0
    • Total Length: 264
    • Identification: 0x0c22 (3106)
    • Flags: 0x04 (Don't Fragment)
      • 0... = Reserved bit: Not set
      • .1.. = Don't fragment: Set
      • ..0. = More fragments: Not set
    • Fragment offset: 0
    • Time to live: 64
    • Protocol: TCP (0x06)
    • Header checksum: 0xd580 [correct]
      • Good: True
      • Bad : False
    • Source: 172.16.0.25 (172.16.0.25)
    • Source or Destination Address: 172.16.0.25 (172.16.0.25)
    • Source Host: 172.16.0.25
    • Source or Destination Host: 172.16.0.25
    • Destination: 172.16.0.20 (172.16.0.20)
    • Source or Destination Address: 172.16.0.20 (172.16.0.20)
    • Destination Host: 172.16.0.20
    • Source or Destination Host: 172.16.0.20
  • Transmission Control Protocol, Src Port: commplex-main (5000), Dst Port: 56594 (56594), Seq: 72, Ack: 1131, Len: 224
    • Source port: commplex-main (5000)
    • Destination port: 56594 (56594)
    • Source or Destination Port: 5000
    • Source or Destination Port: 56594
    • TCP Segment Len: 224
    • Sequence number: 72 (relative sequence number)
    • Next sequence number: 296 (relative sequence number)
    • Acknowledgement number: 1131 (relative ack number)
    • Header length: 20 bytes
    • Flags: 0x18 (PSH, ACK)
      • 0... .... = Congestion Window Reduced (CWR): Not set
      • .0.. .... = ECN-Echo: Not set
      • ..0. .... = Urgent: Not set
      • ...1 .... = Acknowledgment: Set
      • .... 1... = Push: Set
      • .... .0.. = Reset: Not set
      • .... ..0. = Syn: Not set
      • .... ...0 = Fin: Not set
    • Window size: 17520
    • Checksum: 0xe601 [correct]
      • Good Checksum: True
      • Bad Checksum: False
    • SEQ/ACK analysis
      • This is an ACK to the segment in frame: 65
      • The RTT to ACK the segment was: 0.019528000 seconds
  • Real Time Streaming Protocol
    • Response: RTSP/1.0 200 OK\r\n
      • Status: 200
    • CSeq: 2\r\n
    • Session: 809EFC70
    • Transport: RTP/AVP/UDP;unicast;interleaved=0-1;mode=record;control_port=6001;timing_port=6002;server_port=6000
    • Audio-Jack-Status: connected; type=analog\r\n
    • Audio-Latency: 11025\r\n
    • \r\n

The session was successfully setup.  UDP 6002 port was used to be a RTP timing flow and UDP 6001 port was used to be a control session; In the mean while, the Audio payload were to be transmitted through a flow over UDP port 6000 in the format of RTP dynamic payload.

No. Source Destination Protocol Info Time
82 172.16.0.20 172.16.0.25 RTP
PT=Unknown (96), SSRC=0x954C30BE, Seq=57732, Time=320184008
 55.539615
83 172.16.0.20 172.16.0.25 RTP
PT=Unknown (96), SSRC=0x954C30BE, Seq=57733, Time=320184360
 55.547642
84 172.16.0.20 172.16.0.25 RTP
PT=Unknown (96), SSRC=0x954C30BE, Seq=57734, Time=320184712
 55.555631
85 172.16.0.20 172.16.0.25 RTP
PT=Unknown (96), SSRC=0x954C30BE, Seq=57735, Time=320185064
 55.563610
86 172.16.0.20 172.16.0.25 RTP
PT=Unknown (96), SSRC=0x954C30BE, Seq=57736, Time=320185416
 55.571610

The interactive process is very clean and elegant. Usage of MDNS is a smart way to discover one or many AirPlay devices in the network. Enjoy it.

 

Apple, Applications
, , , , , , ,

RTSP Movie play

August 8, 2011 0 Comments

The Real Time Streaming Protocol (RTSP) is a network control protocol designed for use in entertainment and communications systems to control streaming media servers. The protocol is used for establishing and controlling media sessions between end points. Clients of media servers issue VCR-like commands, such as play and pause, to facilitate real-time control of playback of media files from the server.

There is a sample

No. Source Destination Protocol Info Time
4 172.16.24.125 172.16.11.13 RTSP
DESCRIBE rtsp://172.16.11.13/sample_100kbit.mov RTSP/1.0
 0.116546
6 172.16.11.13 172.16.24.125 RTSP/SDP
Reply: RTSP/1.0 200 OK, with session description
 0.119646
8 172.16.24.125 172.16.11.13 RTSP
SETUP rtsp://172.16.11.13/sample_100kbit.mov/trackID=3 RTSP/1.0
 1.081125
10 172.16.11.13 172.16.24.125 RTSP
OPTIONS * RTSP/1.0
 1.083721
12 172.16.24.125 172.16.11.13 RTSP
Reply: RTSP/1.0 501 Not Implemented
 1.150129
13 172.16.11.13 172.16.24.125 RTSP
Reply: RTSP/1.0 200 OK
 1.151050
14 172.16.24.125 172.16.11.13 RTSP
SETUP rtsp://172.16.11.13/sample_100kbit.mov/trackID=4 RTSP/1.0
 1.156360
15 172.16.11.13 172.16.24.125 RTSP
Reply: RTSP/1.0 200 OK
 1.157859
16 172.16.24.125 172.16.11.13 RTSP
PLAY rtsp://172.16.11.13/sample_100kbit.mov RTSP/1.0
 1.178201
17 172.16.11.13 172.16.24.125 RTSP
Reply: RTSP/1.0 200 OK
 1.179988
18 172.16.11.13 172.16.24.125 RTP
PT=Unknown (97), SSRC=0x740B4420, Seq=44385, Time=983828337
 1.180477
19 172.16.11.13 172.16.24.125 RTCP
Sender Report Source description Application specific ( qtsi ) subtype=1
 1.180505
20 172.16.11.13 172.16.24.125 RTP
PT=Unknown (96), SSRC=0x7245800F, Seq=24759, Time=1285219020
 1.180511
21 172.16.11.13 172.16.24.125 RTCP
Sender Report Source description Application specific ( qtsi ) subtype=1
 1.180517
22 172.16.11.13 172.16.24.125 RTP
PT=Unknown (96), SSRC=0x7245800F, Seq=24760, Time=1285219020, Mark
 1.180526
23 172.16.11.13 172.16.24.125 RTP
PT=Unknown (96), SSRC=0x7245800F, Seq=24761, Time=1285225020, Mark
 1.180532
24 172.16.11.13 172.16.24.125 RTP
PT=Unknown (96), SSRC=0x7245800F, Seq=24762, Time=1285231020, Mark
 1.180717

 

We can look into the setup process by following packet

  • Frame 4 (266 bytes on wire, 266 bytes captured)
    • Arrival Time: May 9, 2007 16:47:42.806776046
    • Time delta from previous captured frame: 0.115076065 seconds
    • Time delta from previous displayed frame: 0.115076065 seconds
    • Time since reference or first frame: 0.116544723 seconds
    • Frame Number: 4
    • Packet Length: 266 bytes
    • Frame Length: 266 bytes
    • Capture Length: 266 bytes
    • Frame is marked: False
    • Protocols in frame: eth:ip:tcp:rtsp
  • Ethernet II, Src: Ibm_45:2a:c4 (00:11:25:45:2a:c4), Dst: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
    • Destination: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • Address: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Source: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • Address: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Type: IP (0x0800)
  • Internet Protocol, Src: 172.16.24.125 (172.16.24.125), Dst: 172.16.11.13 (172.16.11.13)
    • Version: 4
    • Header length: 20 bytes
    • Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      • 0000 00.. = Differentiated Services Codepoint: Default (0x00)
      • .... ..0. = ECN-Capable Transport (ECT): 0
      • .... ...0 = ECN-CE: 0
    • Total Length: 252
    • Identification: 0x3b7c (15228)
    • Flags: 0x04 (Don't Fragment)
      • 0... = Reserved bit: Not set
      • .1.. = Don't fragment: Set
      • ..0. = More fragments: Not set
    • Fragment offset: 0
    • Time to live: 128
    • Protocol: TCP (0x06)
    • Header checksum: 0x42d5 [correct]
      • Good: True
      • Bad : False
    • Source: 172.16.24.125 (172.16.24.125)
    • Source or Destination Address: 172.16.24.125 (172.16.24.125)
    • Source Host: 172.16.24.125
    • Source or Destination Host: 172.16.24.125
    • Destination: 172.16.11.13 (172.16.11.13)
    • Source or Destination Address: 172.16.11.13 (172.16.11.13)
    • Destination Host: 172.16.11.13
    • Source or Destination Host: 172.16.11.13
  • Transmission Control Protocol, Src Port: remote-winsock (1745), Dst Port: rtsp (554), Seq: 1, Ack: 1, Len: 212
    • Source port: remote-winsock (1745)
    • Destination port: rtsp (554)
    • Source or Destination Port: 1745
    • Source or Destination Port: 554
    • TCP Segment Len: 212
    • Sequence number: 1 (relative sequence number)
    • Next sequence number: 213 (relative sequence number)
    • Acknowledgement number: 1 (relative ack number)
    • Header length: 20 bytes
    • Flags: 0x18 (PSH, ACK)
      • 0... .... = Congestion Window Reduced (CWR): Not set
      • .0.. .... = ECN-Echo: Not set
      • ..0. .... = Urgent: Not set
      • ...1 .... = Acknowledgment: Set
      • .... 1... = Push: Set
      • .... .0.. = Reset: Not set
      • .... ..0. = Syn: Not set
      • .... ...0 = Fin: Not set
    • Window size: 204800 (scaled)
    • Checksum: 0x7c99 [incorrect, should be 0xef87 (maybe caused by "TCP checksum offload"?)]
      • Good Checksum: False
      • Bad Checksum: True
  • Real Time Streaming Protocol
    • Request: DESCRIBE rtsp://172.16.11.13/sample_100kbit.mov RTSP/1.0\r\n
      • Method: DESCRIBE
      • URL: rtsp://172.16.11.13/sample_100kbit.mov
    • CSeq: 1\r\n
    • Accept: application/sdp\r\n
    • Bandwidth: 384000\r\n
    • Accept-Language: hr-HR\r\n
    • User-Agent: QuickTime/7.1.6 (qtver=7.1.6;os=Windows NT 5.1Service Pack 2)\r\n
    • \r\n

And then the media server responsed

  • Frame 6 (856 bytes on wire, 856 bytes captured)
    • Arrival Time: May 9, 2007 16:47:42.809875488
    • Time delta from previous captured frame: 0.002174378 seconds
    • Time delta from previous displayed frame: 0.002174378 seconds
    • Time since reference or first frame: 0.119644165 seconds
    • Frame Number: 6
    • Packet Length: 856 bytes
    • Frame Length: 856 bytes
    • Capture Length: 856 bytes
    • Frame is marked: False
    • Protocols in frame: eth:ip:tcp:rtsp:sdp
  • Ethernet II, Src: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0), Dst: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
    • Destination: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • Address: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Source: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • Address: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Type: IP (0x0800)
  • Internet Protocol, Src: 172.16.11.13 (172.16.11.13), Dst: 172.16.24.125 (172.16.24.125)
    • Version: 4
    • Header length: 20 bytes
    • Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      • 0000 00.. = Differentiated Services Codepoint: Default (0x00)
      • .... ..0. = ECN-Capable Transport (ECT): 0
      • .... ...0 = ECN-CE: 0
    • Total Length: 842
    • Identification: 0x2da4 (11684)
    • Flags: 0x04 (Don't Fragment)
      • 0... = Reserved bit: Not set
      • .1.. = Don't fragment: Set
      • ..0. = More fragments: Not set
    • Fragment offset: 0
    • Time to live: 63
    • Protocol: TCP (0x06)
    • Header checksum: 0x8f5f [correct]
      • Good: True
      • Bad : False
    • Source: 172.16.11.13 (172.16.11.13)
    • Source or Destination Address: 172.16.11.13 (172.16.11.13)
    • Source Host: 172.16.11.13
    • Source or Destination Host: 172.16.11.13
    • Destination: 172.16.24.125 (172.16.24.125)
    • Source or Destination Address: 172.16.24.125 (172.16.24.125)
    • Destination Host: 172.16.24.125
    • Source or Destination Host: 172.16.24.125
  • Transmission Control Protocol, Src Port: rtsp (554), Dst Port: remote-winsock (1745), Seq: 1, Ack: 213, Len: 802
    • Source port: rtsp (554)
    • Destination port: remote-winsock (1745)
    • Source or Destination Port: 554
    • Source or Destination Port: 1745
    • TCP Segment Len: 802
    • Sequence number: 1 (relative sequence number)
    • Next sequence number: 803 (relative sequence number)
    • Acknowledgement number: 213 (relative ack number)
    • Header length: 20 bytes
    • Flags: 0x18 (PSH, ACK)
      • 0... .... = Congestion Window Reduced (CWR): Not set
      • .0.. .... = ECN-Echo: Not set
      • ..0. .... = Urgent: Not set
      • ...1 .... = Acknowledgment: Set
      • .... 1... = Push: Set
      • .... .0.. = Reset: Not set
      • .... ..0. = Syn: Not set
      • .... ...0 = Fin: Not set
    • Window size: 6912 (scaled)
    • Checksum: 0xeac9 [correct]
      • Good Checksum: True
      • Bad Checksum: False
  • Real Time Streaming Protocol
    • Response: RTSP/1.0 200 OK\r\n
      • Status: 200
    • Server: DSS/5.5.5 (Build/489.16; Platform/Linux; Release/Darwin; state/beta; )\r\n
    • Cseq: 1\r\n
    • Last-Modified: Wed, 30 May 2007 07:23:12 GMT\r\n
    • Cache-Control: must-revalidate\r\n
    • Content-length: 369
    • Date: Wed, 30 May 2007 08:47:58 GMT\r\n
    • Expires: Wed, 30 May 2007 08:47:58 GMT\r\n
    • Content-type: application/sdp
    • x-Accept-Retransmit: our-retransmit\r\n
    • x-Accept-Dynamic-Rate: 1\r\n
    • Content-Base: rtsp://172.16.11.13/sample_100kbit.mov/\r\n
    • \r\n
    • Session Description Protocol
      • Session Description Protocol Version (v): 0
      • Owner/Creator, Session Id (o): StreamingServer 3389503678 1180509792000 IN IP4 172.16.11.13
        • Owner Username: StreamingServer
        • Session ID: 3389503678
        • Session Version: 1180509792000
        • Owner Network Type: IN
        • Owner Address Type: IP4
        • Owner Address: 172.16.11.13
      • Session Name (s): /sample_100kbit.mov
      • URI of Description (u): http:///
      • E-mail Address (e): admin@
      • Connection Information (c): IN IP4 0.0.0.0
        • Connection Network Type: IN
        • Connection Address Type: IP4
        • Connection Address: 0.0.0.0
      • Bandwidth Information (b): AS:94
        • Bandwidth Modifier: AS [Application Specific (RTP session bandwidth)]
        • Bandwidth Value: 94 kb/s
      • Time Description, active time (t): 0 0
        • Session Start Time: 0
        • Session Stop Time: 0
      • Session Attribute (a): control:*
        • Session Attribute Fieldname: control
        • Session Attribute Value: *
      • Session Attribute (a): range:npt=0- 70.00000
        • Session Attribute Fieldname: range
        • Session Attribute Value: npt=0- 70.00000
      • Media Description, name and address (m): video 0 RTP/AVP 96
        • Media Type: video
        • Media Port: 0
        • Media Proto: RTP/AVP
        • Media Format: 96
      • Bandwidth Information (b): AS:79
        • Bandwidth Modifier: AS [Application Specific (RTP session bandwidth)]
        • Bandwidth Value: 79 kb/s
      • Media Attribute (a): rtpmap:96 X-SV3V-ES/90000
        • Media Attribute Fieldname: rtpmap
        • Media Format: 96
        • MIME Type: X-SV3V-ES
      • Media Attribute (a): control:trackID=3
        • Media Attribute Fieldname: control
        • Media Attribute Value: trackID=3
      • Media Description, name and address (m): audio 0 RTP/AVP 97
        • Media Type: audio
        • Media Port: 0
        • Media Proto: RTP/AVP
        • Media Format: 97
      • Bandwidth Information (b): AS:14
        • Bandwidth Modifier: AS [Application Specific (RTP session bandwidth)]
        • Bandwidth Value: 14 kb/s
      • Media Attribute (a): rtpmap:97 X-QDM/22050/2
        • Media Attribute Fieldname: rtpmap
        • Media Format: 97
        • MIME Type: X-QDM
      • Media Attribute (a): control:trackID=4
        • Media Attribute Fieldname: control
        • Media Attribute Value: trackID=4
      • Media Attribute (a): x-bufferdelay:4.97
        • Media Attribute Fieldname: x-bufferdelay
        • Media Attribute Value: 4.97

In Packet #14 , the media client request to PLAY the specific file

  • Frame 16 (326 bytes on wire, 326 bytes captured)
    • Arrival Time: May 9, 2007 16:47:43.868431091
    • Time delta from previous captured frame: 0.020341873 seconds
    • Time delta from previous displayed frame: 0.020341873 seconds
    • Time since reference or first frame: 1.178199768 seconds
    • Frame Number: 16
    • Packet Length: 326 bytes
    • Frame Length: 326 bytes
    • Capture Length: 326 bytes
    • Frame is marked: False
    • Protocols in frame: eth:ip:tcp:rtsp
  • Ethernet II, Src: Ibm_45:2a:c4 (00:11:25:45:2a:c4), Dst: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
    • Destination: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • Address: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Source: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • Address: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Type: IP (0x0800)
  • Internet Protocol, Src: 172.16.24.125 (172.16.24.125), Dst: 172.16.11.13 (172.16.11.13)
    • Version: 4
    • Header length: 20 bytes
    • Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      • 0000 00.. = Differentiated Services Codepoint: Default (0x00)
      • .... ..0. = ECN-Capable Transport (ECT): 0
      • .... ...0 = ECN-CE: 0
    • Total Length: 312
    • Identification: 0x3b82 (15234)
    • Flags: 0x04 (Don't Fragment)
      • 0... = Reserved bit: Not set
      • .1.. = Don't fragment: Set
      • ..0. = More fragments: Not set
    • Fragment offset: 0
    • Time to live: 128
    • Protocol: TCP (0x06)
    • Header checksum: 0x4293 [correct]
      • Good: True
      • Bad : False
    • Source: 172.16.24.125 (172.16.24.125)
    • Source or Destination Address: 172.16.24.125 (172.16.24.125)
    • Source Host: 172.16.24.125
    • Source or Destination Host: 172.16.24.125
    • Destination: 172.16.11.13 (172.16.11.13)
    • Source or Destination Address: 172.16.11.13 (172.16.11.13)
    • Destination Host: 172.16.11.13
    • Source or Destination Host: 172.16.11.13
  • Transmission Control Protocol, Src Port: remote-winsock (1745), Dst Port: rtsp (554), Seq: 915, Ack: 3283, Len: 272
    • Source port: remote-winsock (1745)
    • Destination port: rtsp (554)
    • Source or Destination Port: 1745
    • Source or Destination Port: 554
    • TCP Segment Len: 272
    • Sequence number: 915 (relative sequence number)
    • Next sequence number: 1187 (relative sequence number)
    • Acknowledgement number: 3283 (relative ack number)
    • Header length: 20 bytes
    • Flags: 0x18 (PSH, ACK)
      • 0... .... = Congestion Window Reduced (CWR): Not set
      • .0.. .... = ECN-Echo: Not set
      • ..0. .... = Urgent: Not set
      • ...1 .... = Acknowledgment: Set
      • .... 1... = Push: Set
      • .... .0.. = Reset: Not set
      • .... ..0. = Syn: Not set
      • .... ...0 = Fin: Not set
    • Window size: 203804 (scaled)
    • Checksum: 0x7cd5 [incorrect, should be 0x47a8 (maybe caused by "TCP checksum offload"?)]
      • Good Checksum: False
      • Bad Checksum: True
    • SEQ/ACK analysis
      • This is an ACK to the segment in frame: 15
      • The RTT to ACK the segment was: 0.020341873 seconds
  • Real Time Streaming Protocol
    • Request: PLAY rtsp://172.16.11.13/sample_100kbit.mov RTSP/1.0\r\n
      • Method: PLAY
      • URL: rtsp://172.16.11.13/sample_100kbit.mov
    • CSeq: 4\r\n
    • Range: npt=0.000000-70.000000\r\n
    • x-prebuffer: maxtime=2.000000\r\n
    • x-transport-options: late-tolerance=10\r\n
    • Session: 5062439775066245259
    • User-Agent: QuickTime/7.1.6 (qtver=7.1.6;os=Windows NT 5.1Service Pack 2)\r\n
    • \r\n

After confirm from media server, the RTP (realtime transportation Protocol)  packet then used to transmit the actual video/audio

  • Frame 18 (950 bytes on wire, 950 bytes captured)
    • Arrival Time: May 9, 2007 16:47:43.870706558
    • Time delta from previous captured frame: 0.000488282 seconds
    • Time delta from previous displayed frame: 0.000488282 seconds
    • Time since reference or first frame: 1.180475235 seconds
    • Frame Number: 18
    • Packet Length: 950 bytes
    • Frame Length: 950 bytes
    • Capture Length: 950 bytes
    • Frame is marked: False
    • Protocols in frame: eth:ip:udp:rtp
  • Ethernet II, Src: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0), Dst: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
    • Destination: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • Address: Ibm_45:2a:c4 (00:11:25:45:2a:c4)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Source: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • Address: Cisco_b6:8c:a0 (00:0b:5f:b6:8c:a0)
      • .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
      • .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    • Type: IP (0x0800)
  • Internet Protocol, Src: 172.16.11.13 (172.16.11.13), Dst: 172.16.24.125 (172.16.24.125)
    • Version: 4
    • Header length: 20 bytes
    • Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      • 0000 00.. = Differentiated Services Codepoint: Default (0x00)
      • .... ..0. = ECN-Capable Transport (ECT): 0
      • .... ...0 = ECN-CE: 0
    • Total Length: 936
    • Identification: 0x2bc8 (11208)
    • Flags: 0x04 (Don't Fragment)
      • 0... = Reserved bit: Not set
      • .1.. = Don't fragment: Set
      • ..0. = More fragments: Not set
    • Fragment offset: 0
    • Time to live: 63
    • Protocol: UDP (0x11)
    • Header checksum: 0x90d2 [correct]
      • Good: True
      • Bad : False
    • Source: 172.16.11.13 (172.16.11.13)
    • Source or Destination Address: 172.16.11.13 (172.16.11.13)
    • Source Host: 172.16.11.13
    • Source or Destination Host: 172.16.11.13
    • Destination: 172.16.24.125 (172.16.24.125)
    • Source or Destination Address: 172.16.24.125 (172.16.24.125)
    • Destination Host: 172.16.24.125
    • Source or Destination Host: 172.16.24.125
  • User Datagram Protocol, Src Port: 6970 (6970), Dst Port: 6972 (6972)
    • Source port: 6970 (6970)
    • Destination port: 6972 (6972)
    • Source or Destination Port: 6970
    • Source or Destination Port: 6972
    • Length: 916
    • Checksum coverage: 916
    • Checksum: 0x1774 [correct]
      • Good Checksum: True
      • Bad Checksum: False
  • Real-Time Transport Protocol
    • Stream setup by RTSP (frame 15)
      • Setup frame: 15
      • Setup Method: RTSP
    • 10.. .... = Version: RFC 1889 Version (2)
    • ..0. .... = Padding: False
    • ...0 .... = Extension: False
    • .... 0000 = Contributing source identifiers count: 0
    • 0... .... = Marker: False
    • Payload type: Unknown (97)
    • Sequence number: 44385
    • Extended sequence number: 44385
    • Timestamp: 983828337
    • Synchronization Source identifier: 0x740b4420 (1946895392)
    • Payload: FF040300020302061E040000000100000002000056220000...
Applications
, , , ,