Search code examples
scapyrtp

Decode RTP over UDP with Scapy

How can I decode (and manipulate) RTP over UDP with Scapy 2.3.2?

I have a capture file called rtp.pcap which contains an RTP audiostream to 224.0.1.11:5016. Wireshark correctly decodes the stream when you enable the RTP over UDP protocol (default off). However, I want to do automatic packet manipulation, so I would like to decode it with Scapy.

Currently, Scapy does not recognize RTP, although there is an RTP layer:

>>> from scapy.all import RTP # shows that RTP layer is installed in my version
>>> pkts = sniff(offline="rtp.pcap", filter="udp dst port 5016")
>>> pkts[0].show()
[...]
###[ UDP ]###
    sport= 5004
    dport= 5016
    len= 196 <-- thats an audio pkt
[...]
###[ Raw ]###
       load= ...
[...]
Solution

  • The following code forces the UDP Payload to be interpreted as RTP:

    from scapy.all import RTP
for pkt in pkts:
    if pkt["UDP"].dport==5016: # Make sure its actually RTP
        pkt["UDP"].payload = RTP(pkt["Raw"].load)