how to find from RTP stream that it belong to which sip call?

Question

If I only have RTP stream, is there a way to find out SIP info of the call, like from/to call id?

Answer 1

Nope.

If you take a look at the RTP header fields you'll see there's not really much there and certainly none of the SIP information you're after.

Answer 2

I agree with sipwiz.

If you can't find it, here's a hint.

If you look at the UDP ports (src and dst) from your RTP stream, you can "deduce" where that RTP stream were originated from. But if you have no SIP packets at all, you can't do anything.

Suppose you have it... For example, let's say you have a RTP packet from src port: 8000 and dst port: 20226. then you can apply wireshark filter:

sdp matches "20226"

You'll then see which SDP (and then find the call-ID) contains that port, then by applying another filter with the call-ID, you'll see which SIP transaction "started" that RTP packet.

Answer 3

I too agree with sipwiz. There is no option to find details about the SIP call with just having only the RTP packets.