RTSP was first specified in RFC2326.
pcap attached to issue #5081 Uninitialised pointer in packet-rtsp.c causes crash
XXX - Add example traffic here (as plain text or Wireshark screenshot).
The RTSP dissector is fully functional over TCP, but currently doesn't handle RTSP-over-UDP.
(Text below needs update. Screen shot above from 3.6.3.)
There are four preference settings affecting RTSP.
This preference specifies the first of the TCP ports on which the RTSP dissector will check for traffic. The default is 554.
This preference specifies the second of the TCP ports on which the RTSP dissector will check for traffic. The default is 8554.
When this preference is enabled, then the RTSP dissector will reassemble the RTSP header if it has been transmitted over more than one TCP segment. Although it is unusual for headers span multiple segments, it's not impossible, and this should be checked if you expect to view the contents of the RTSP conversation.
When this preference is enabled, then the RTSP dissector will reassemble the RTSP body if it has been transmitted over more than one TCP segment.
A complete list of RTSP display filter fields can be found in the display filter reference
Show only the RTSP based traffic:
You cannot directly filter RTSP protocols while capturing. However, if you know the TCP port used (see above), you can filter on that one.
Capture RTSP traffic over the default port (554):
tcp port 554
Capture RTSP traffic over the alternate port (8554):
tcp port 8554
- RFC2326 Real Time Streaming Protocol (RTSP)
Imported from https://wiki.wireshark.org/RTSP on 2020-08-11 23:24:15 UTC