Exported RTP payload in packet metadata

Added ndpi_rtp_payload_type2str() API call
ntop · Feb 19, 2025 · 3bef876 · 3bef876
1 parent e052e5b
commit 3bef876
Show file tree

Hide file tree

Showing 7 changed files with 65 additions and 3 deletions.
diff --git a/example/ndpiReader.c b/example/ndpiReader.c
@@ -1870,6 +1870,13 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
       fprintf(out, "[Stream Content: %s]", ndpi_multimedia_flowtype2str(content, sizeof(content), flow->multimedia_flow_types));
     }
 
+    if((flow->detected_protocol.proto.master_protocol == NDPI_PROTOCOL_RTP) || (flow->detected_protocol.proto.app_protocol == NDPI_PROTOCOL_RTP))
+      {
+	fprintf(out, "[Payload Type: %s (%u)]",
+		ndpi_rtp_payload_type2str(flow->rtp.payload_type),
+		flow->rtp.payload_type);
+      }
+
     fprintf(out, "[%s]",
 	    ndpi_is_encrypted_proto(ndpi_thread_info[thread_id].workflow->ndpi_struct,
 				    flow->detected_protocol) ? "Encrypted" : "ClearText");

diff --git a/example/reader_util.c b/example/reader_util.c
@@ -1637,6 +1637,9 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
     ndpi_snprintf(flow->http.password, sizeof(flow->http.password), "%s", flow->ndpi_flow->http.password ? flow->ndpi_flow->http.password : "");
   }
 
+  if(is_ndpi_proto(flow, NDPI_PROTOCOL_RTP))
+    flow->rtp.payload_type = flow->ndpi_flow->protos.rtp.payload_type;
+
   ndpi_snprintf(flow->http.user_agent,
                 sizeof(flow->http.user_agent),
                 "%s", (flow->ndpi_flow->http.user_agent ? flow->ndpi_flow->http.user_agent : ""));

diff --git a/example/reader_util.h b/example/reader_util.h
@@ -316,6 +316,10 @@ typedef struct ndpi_flow_info {
     u_int response_status_code;
   } http;
 
+  struct {
+    u_int8_t payload_type;
+  } rtp;
+
   struct {
     ndpi_address_port_list mapped_address, peer_address,
       relayed_address, response_origin, other_address;

diff --git a/src/include/ndpi_api.h b/src/include/ndpi_api.h
@@ -599,6 +599,14 @@ extern "C" {
   ndpi_protocol_qoe_category_t ndpi_find_protocol_qoe(struct ndpi_detection_module_struct *ndpi_str,
 						      u_int16_t protoId);
 
+  /**
+   * Return the name of a RTP payload type
+   *
+   * @par     payload_type = the RTP payload type
+   * @return  The symbolic payload type or "Unknown" if not found
+   */
+  const char* ndpi_rtp_payload_type2str(u_int8_t payload_type);
+
   /**
    * Check if subprotocols of the specified master protocol are just
    * informative (and not real)

diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
@@ -1600,6 +1600,10 @@ struct ndpi_flow_struct {
       char *st;
       char *user_agent;
     } ssdp;
+
+    struct {
+      u_int8_t payload_type;
+    } rtp;
 } protos;
 
   /* **Packet** metadata for flows where monitoring is enabled. It is reset after each packet! */

diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
@@ -4234,3 +4234,38 @@ ndpi_protocol_qoe_category_t ndpi_find_protocol_qoe(struct ndpi_detection_module
     return(ndpi_str->proto_defaults[protoId].qoeCategory);
 }
 
+/* ************************************************************** */
+
+const char* ndpi_rtp_payload_type2str(u_int8_t payload_type) {
+  switch(payload_type) {
+  case 0:   return("ITU-T G.711 PCMU");
+  case 1:   return("USA Federal Standard FS-1016");
+  case 2:   return("ITU-T G.721");
+  case 3:   return("GSM 06.10");
+  case 4:   return("ITU-T G.723");
+  case 5:   return("DVI4 8000 samples/s");
+  case 6:   return("DVI4 16000 samples/s");
+  case 8:   return("ITU-T G.711 PCMA");
+  case 9:   return("ITU-T G.722");
+  case 10:  return("16-bit uncompressed audio, stereo");
+  case 11:  return("16-bit uncompressed audio, monaural");
+  case 12:  return("Qualcomm Code Excited Linear Predictive coding");
+  case 13:  return("Comfort noise");
+  case 14:  return("MPEG-I/II Audio");
+  case 15:  return("ITU-T G.728");
+  case 16:  return("DVI4 11025 samples/s");
+  case 17:  return("DVI4 22050 samples/s");
+  case 18:  return("ITU-T G.729");
+  case 19:  return("Comfort noise (old)");
+  case 25:  return("Sun CellB video encoding");
+  case 26:  return("JPEG-compressed video");
+  case 28:  return("'nv' program");
+  case 31:  return("ITU-T H.261");
+  case 32:  return("MPEG-I/II Video");
+  case 33:  return("MPEG-II transport streams");
+  case 34:  return("ITU-T H.263");
+  case 98:  return("AMR-WB");
+  case 127: return("EVS");
+  default:  return("Unknown");
+  }
+}
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
@@ -307,12 +307,13 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
   is_rtp = is_rtp_or_rtcp(ndpi_struct, payload, payload_len, &seq);
 
   if(is_rtp == IS_RTP) {
+    flow->protos.rtp.payload_type = payload[1] & 0x7F;
+
     if(flow->rtp_stage == 2) {
       if(flow->l4_proto == IPPROTO_UDP &&
          flow->l4.udp.line_pkts[0] >= 2 && flow->l4.udp.line_pkts[1] >= 2) {
         /* It seems that it is a LINE stuff; let its dissector to evaluate */
-      } else if(flow->l4_proto == IPPROTO_UDP &&
-                flow->l4.udp.epicgames_stage > 0) {
+      } else if(flow->l4_proto == IPPROTO_UDP && flow->l4.udp.epicgames_stage > 0) {
         /* It seems that it is a EpicGames stuff; let its dissector to evaluate */
       } else if(flow->rtp_seq_set[packet->packet_direction] &&
                 flow->rtp_seq[packet->packet_direction] == seq) {
@@ -325,7 +326,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
         NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
         NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
       } else {
-        rtp_get_stream_type(payload[1] & 0x7F, &flow->flow_multimedia_types, NDPI_PROTOCOL_UNKNOWN);
+        rtp_get_stream_type(flow->protos.rtp.payload_type, &flow->flow_multimedia_types, NDPI_PROTOCOL_UNKNOWN);
 
         NDPI_LOG_INFO(ndpi_struct, "Found RTP\n");
         ndpi_int_rtp_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTP);