使用pcap过滤sdp数据包

Question

I want to filter sdp packets to be able to identify the possible sessions initiations for rtp streams. I'm using pcap library for c++ to read the packets and I would like to write a parser for sdp packets but I don't know which protocols can encapsulate sdp other than SIP and MGCP (I mean after UDP). Or If anybody can shed any light on how does wireshark filters/identifys SDP packets.

Answer 1

If we limit ourselves to the protocols over which SDP can directly run, then, if we look at the current master-branch version of Wireshark:

• any protocol that uses a media type to describe its payload could, in principle, carry SDP, with a media type value of "application/sdp", although I don't know whether, in practice, you'll ever see, for example, SDP-over-HTTP rather than, say, SDP-over-SIP;
• the BICC bearer control tunneling protocol, specified in ITU-T Recommendation Q.1990 , can carry SDP, with the Tunneled Protocol Indicator having the value of 0x20 for SDP;
• the Cisco Session Management protocol can carry SDP;
• the ISUP (ISDN User Part) protocol can carry SDP;
• the Gateway Control protocol ( RFC 3525 ; an earlier version was called MEGACO) and MGCP ( RFC 3435 ) can carry SDP;
• the Session Announcement Protocol ( RFC 2974 ) can carry SDP.

Which of those you will see in present-day network traffic is another matter.

As for the protocols on top of which those run, well, most of them run on top of TCP or possibly UDP, or on top of something that ultimately runs on top of TCP or possibly UDP, which means that they will then run on top of IPv4 or IPv6, which means that they will then run on top of any link layer that can transport IPv4 or IPv6, meaning Ethernet and 802.11 and PPP and....

However, ISUP, at least, can run on top of old-fashioned telephony networking stacks, such as the Signaling System No. 7 stack; whether it transports SDP when run on those stacks is another matter.