IP / UDP / RTP header decoding

[mpaddict]

Hi,
I was wondering if someone could help me decode the following headers:

http://img185.imageshack.us/img185/1416/headersflat201do5.gif

I believe I have most of the IP header decoded, however there are still 4 bytes which I'm unsure as to what they mean. I think bytes 2 and 3 are used to compute the section length (big endian), but I have no clue about bytes 17 and 18. It sort of makes sense that bytes 15 and 16 represent IP length since they add up to "1344 bytes".

http://img530.imageshack.us/img530/5021/headersflat202pa2.gif

I've tried researching UDP and RTP headers online but none of the diagrams I came across seem to match these headers (same with the IP header).

UDP: if I were to guess the second byte (11 = 17 decimal) is some sort of protocol value. I'd also expect a source / destination ip and port in there somewhere.

RTP: So far I'm leaning towards bytes number 3 and 4 being some sort of sequence number and perhaps bytes 5-8 a timestamp?

(I apologize if I posted it in the wrong subforum)

Thank you

[mitsubishi]

This looks like a DSM-CC IP-datagram table from a mpeg2 transport stream to me. First you have the DSM table header, the second and third bytes are indeed the section length, like they are on every table, but it is 12-bit, so ignore the first four bits (actually the first bit actually means something in DSM unlike other mpeg tables, but its a 1 anyway)

The IP header is 5 bytes, like you said, but for some reason you are counting the DSM header also. (45, 4 means IP4, 5 means 5 bytes).

74C3 is the datagram identification. so you know which datagram the packet belongs. (in this case the packet contains the whole datagram, because...)
4000 is in binary 010 0000000000000 and 010 means 0=nothing, 1, Don't fragment, 0, Last fragment. The remaining bits make up fragment offset.
So in this case you know it is the last fragment and it goes at position 0 in the datagram (ie its the only fragment).

Then you have:
Time to live: 1 byte
Protocol: 1 byte (11=UDP)
Header Checksum: 2 bytes
Source Address: 4 bytes
Destination Address: 4 bytes

Then C3 is the start of the UDP header

Source port: 2 bytes
Destination port: 2 bytes
Length: 2 bytes
Checksum: 2 bytes

This is all in rfc791 (IP) and rfc768 (UDP).

[fibbingbear]

Try using Wireshark to analyze it. It's pretty slick.

[mpaddict]

Hi mitsubishi,

what threw me off was that RTP header. So to sum it all up the first 12 bytes = DSM header, next 20 bytes = IP header and finally last 8 bytes = UDP header.

It all makes a lot more sense now, thanks :)

What I'm trying to do is reconstruct the mpeg stream and with the help you provided I should be able to do just that.

fibbingbear, I tried wireshark, but it cannot open these files.

Thanks again