I am using Tcpdumpto capture packets on my network interface. In Wireshark i can see that RTP and RTCP transactions are going on the same port. I am writing a dissector using Libpcap which will parse and save all the RTP and RTCP packets in different files.
How can i distinguish which one is RTP packet and which is RTCP packet ?
Typically RTP and RTCP are using a different port. However, Duckduckgoing "RTP and RTCP on the same port" gives me Multiplexing RTP and RTCP on a Single Port, RFC5761. Section 4 discusses how to distinguish the two types of packets:
When RTP and RTCP packets are multiplexed onto a single port, the RTCP packet type field occupies the same position in the packet as the combination of the RTP marker (M) bit and the RTP payload type (PT).
[…]
To allow this multiplexing, future RTCP packet type assignments SHOULD be made after the current assignments in the range 209-223, then in the range 194-199, so that only the RTP payload types in the range 64-95 are blocked.
AFAIU, this means that when the two protocol are multiplexed in the same field, and if the RTP packet type is in 64-95, then the packet is not a RTP packet but a RTCP one.
