Skip to content

Commit 30c3613

Browse files
lucaderilucaderi
committed
Improved RTP dissection with EVS and other mobile voice codecs
1 parent 9ee24d5 commit 30c3613

21 files changed

+245
-74
lines changed

‎example/ndpiReader.c

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1872,9 +1872,21 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
18721872

18731873
if((flow->detected_protocol.proto.master_protocol == NDPI_PROTOCOL_RTP) || (flow->detected_protocol.proto.app_protocol == NDPI_PROTOCOL_RTP))
18741874
{
1875-
fprintf(out, "[Payload Type: %s (%u)]",
1876-
ndpi_rtp_payload_type2str(flow->rtp.payload_type),
1877-
flow->rtp.payload_type);
1875+
if (flow->rtp[0 /* cli -> srv */].payload_detected || flow->rtp[1].payload_detected) {
1876+
fprintf(out, "[Payload Type: ");
1877+
1878+
if (flow->rtp[0].payload_detected)
1879+
fprintf(out, "%s (%u.%u)",
1880+
ndpi_rtp_payload_type2str(flow->rtp[0].payload_type, flow->rtp[0].evs_subtype), flow->rtp[0].payload_type, flow->rtp[0].evs_subtype);
1881+
1882+
if(flow->rtp[1 /* srv -> cli */].payload_detected) {
1883+
if (flow->rtp[0].payload_detected) fprintf(out, " / ");
1884+
1885+
fprintf(out, "%s (%u.%u)]",
1886+
ndpi_rtp_payload_type2str(flow->rtp[1].payload_type, flow->rtp[1].evs_subtype), flow->rtp[1].payload_type, flow->rtp[1].evs_subtype);
1887+
} else
1888+
fprintf(out, "]");
1889+
}
18781890
}
18791891

18801892
fprintf(out, "[%s]",

‎example/reader_util.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1216,7 +1216,6 @@ static void serialize_monitoring_metadata(struct ndpi_flow_info *flow)
12161216
case NDPI_PROTOCOL_STUN:
12171217
case NDPI_PROTOCOL_DTLS:
12181218
case NDPI_PROTOCOL_SRTP:
1219-
12201219
ndpi_serialize_start_of_block(&flow->ndpi_flow_serializer, "stun");
12211220

12221221
if(flow->stun.mapped_address.num_aps > 0) {
@@ -1638,7 +1637,7 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
16381637
}
16391638

16401639
if(is_ndpi_proto(flow, NDPI_PROTOCOL_RTP))
1641-
flow->rtp.payload_type = flow->ndpi_flow->protos.rtp.payload_type;
1640+
memcpy(&flow->rtp, &flow->ndpi_flow->protos.rtp, sizeof(flow->rtp));
16421641

16431642
ndpi_snprintf(flow->http.user_agent,
16441643
sizeof(flow->http.user_agent),

‎example/reader_util.h

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -316,9 +316,7 @@ typedef struct ndpi_flow_info {
316316
u_int response_status_code;
317317
} http;
318318

319-
struct {
320-
u_int8_t payload_type;
321-
} rtp;
319+
struct rtp_info rtp[2 /* directions */];
322320

323321
struct {
324322
ndpi_address_port_list mapped_address, peer_address,

‎src/include/ndpi_api.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -602,10 +602,11 @@ extern "C" {
602602
/**
603603
* Return the name of a RTP payload type
604604
*
605-
* @par payload_type = the RTP payload type
605+
* @par payload_type = the RTP payload type
606+
* @par evs_payload_type = EVS payload type (only in case payload_type is EVS)
606607
* @return The symbolic payload type or "Unknown" if not found
607608
*/
608-
const char* ndpi_rtp_payload_type2str(u_int8_t payload_type);
609+
const char* ndpi_rtp_payload_type2str(u_int8_t payload_type, u_int32_t evs_payload_type);
609610

610611
/**
611612
* Check if subprotocols of the specified master protocol are just

‎src/include/ndpi_private.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,7 @@ struct ndpi_detection_module_config_struct {
296296

297297
int stun_opportunistic_tls_enabled;
298298
int stun_max_packets_extra_dissection;
299+
int rtp_max_packets_extra_dissection;
299300
int stun_mapped_address_enabled;
300301
int stun_response_origin_enabled;
301302
int stun_other_address_enabled;

‎src/include/ndpi_typedefs.h

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1301,6 +1301,12 @@ struct ndpi_tls_obfuscated_heuristic_matching_set {
13011301
u_int32_t pkts[4];
13021302
};
13031303

1304+
struct rtp_info {
1305+
u_int8_t payload_type;
1306+
u_int32_t evs_subtype;
1307+
bool payload_detected;
1308+
};
1309+
13041310
struct ndpi_flow_struct {
13051311
u_int16_t detected_protocol_stack[NDPI_PROTOCOL_SIZE];
13061312

@@ -1601,10 +1607,8 @@ struct ndpi_flow_struct {
16011607
char *user_agent;
16021608
} ssdp;
16031609

1604-
struct {
1605-
u_int8_t payload_type;
1606-
} rtp;
1607-
} protos;
1610+
struct rtp_info rtp[2 /* directions */];
1611+
} protos;
16081612

16091613
/* **Packet** metadata for flows where monitoring is enabled. It is reset after each packet! */
16101614
struct ndpi_metadata_monitoring *monit;

‎src/lib/ndpi_main.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11791,7 +11791,8 @@ static const struct cfg_param {
1179111791
{ "zoom", "max_packets_extra_dissection", "4", "0", "255", CFG_PARAM_INT, __OFF(zoom_max_packets_extra_dissection), NULL },
1179211792

1179311793
{ "rtp", "search_for_stun", "disable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(rtp_search_for_stun), NULL },
11794-
11794+
{ "rtp", "max_packets_extra_dissection", "32", "0", "255", CFG_PARAM_INT, __OFF(rtp_max_packets_extra_dissection), NULL },
11795+
1179511796
{ "openvpn", "dpi.heuristics", "0x00", "0", "0x01", CFG_PARAM_INT, __OFF(openvpn_heuristics), NULL },
1179611797
{ "openvpn", "dpi.heuristics.num_messages", "10", "0", "255", CFG_PARAM_INT, __OFF(openvpn_heuristics_num_msgs), NULL },
1179711798
{ "openvpn", "subclassification_by_ip", "enable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(openvpn_subclassification_by_ip), NULL },

‎src/lib/ndpi_utils.c

Lines changed: 58 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4236,7 +4236,8 @@ ndpi_protocol_qoe_category_t ndpi_find_protocol_qoe(struct ndpi_detection_module
42364236

42374237
/* ************************************************************** */
42384238

4239-
const char* ndpi_rtp_payload_type2str(u_int8_t payload_type) {
4239+
/* https://gitlab.com/wireshark/wireshark/-/blob/master/epan/dissectors/packet-rtp.c */
4240+
const char* ndpi_rtp_payload_type2str(u_int8_t payload_type, u_int32_t evs_payload_type) {
42404241
switch(payload_type) {
42414242
case 0: return("ITU-T G.711 PCMU");
42424243
case 1: return("USA Federal Standard FS-1016");
@@ -4265,7 +4266,62 @@ const char* ndpi_rtp_payload_type2str(u_int8_t payload_type) {
42654266
case 33: return("MPEG-II transport streams");
42664267
case 34: return("ITU-T H.263");
42674268
case 98: return("AMR-WB");
4268-
case 127: return("EVS");
4269+
case 118: return("AMR"); /* Adptive Multirate */
4270+
case 126: /* Enhanced Voice Services */
4271+
case 127: /* Enhanced Voice Services */
4272+
{
4273+
switch(evs_payload_type) {
4274+
/* https://gitlab.com/wireshark/wireshark/-/blob/master/epan/dissectors/packet-evs.c */
4275+
4276+
case 0x0: return("AMR-WB IO 6.6 kbps");
4277+
case 0x1: return("AMR-WB IO 8.85 kbps");
4278+
case 0x2: return("AMR-WB IO 12.65 kbps");
4279+
case 0x3: return("AMR-WB IO 14.24 kbps");
4280+
case 0x4: return("AMR-WB IO 15.85 kbps");
4281+
case 0x5: return("AMR-WB IO 18.25 kbps");
4282+
case 0x6: return("AMR-WB IO 19.85 kbps");
4283+
case 0x7: return("AMR-WB IO 23.05 kbps");
4284+
case 0x8: return("AMR-WB IO 23.85 kbps");
4285+
case 0x9: return("AMR-WB IO 2.0 kbps SID");
4286+
4287+
/* ** */
4288+
/* Dummy SWB 30 offset */
4289+
case 0x3+30: return("SWB 9.6 kbps");
4290+
case 0x4+30: return("SWB 13.2 kbps");
4291+
case 0x5+30: return("SWB 16.4 kbps");
4292+
case 0x6+30: return("SWB 24.4 kbps");
4293+
case 0x7+30: return("SWB 32 kbps");
4294+
case 0x8+30: return("SWB 48 kbps");
4295+
case 0x9+30: return("SWB 64 kbps");
4296+
case 0xa+30: return("SWB 96 kbps");
4297+
case 0xb+30: return("SWB 128 kbps");
4298+
4299+
4300+
case 48: return("EVS Primary SID 2.4");
4301+
case 136: return("EVS AMR-WB IO 6.6");
4302+
case 144: return("EVS Primary 7.2");
4303+
case 160: return("EVS Primary 8.0");
4304+
case 184: return("EVS AMR-WB IO 8.85");
4305+
case 192: return("EVS Primary 9.6");
4306+
case 256: return("EVS AMR-WB IO 12.65");
4307+
case 264: return("EVS Primary 13.2");
4308+
case 288: return("EVS AMR-WB IO 14.25");
4309+
case 320: return("EVS AMR-WB IO 15.85");
4310+
case 328: return("EVS Primary 16.4");
4311+
case 368: return("EVS AMR-WB IO 18.25");
4312+
case 400: return("EVS AMR-WB IO 19.85");
4313+
case 464: return("EVS AMR-WB IO 23.05");
4314+
case 480: return("EVS AMR-WB IO 23.85");
4315+
case 488: return("EVS Primary 24.4");
4316+
case 640: return("EVS Primary 32.0");
4317+
case 960: return("EVS Primary 48.0");
4318+
case 1280: return("EVS Primary 64.0");
4319+
case 1920: return("EVS Primary 96.0");
4320+
case 2560: return("EVS Primary 128.0");
4321+
default: return("EVS 13.2");
4322+
}
4323+
}
4324+
break;
42694325
default: return("Unknown");
42704326
}
42714327
}

0 commit comments

Comments
 (0)