rtpbreak

rtpbreak is a tool designed to detect, reconstruct, and analyze Real-time Transport Protocol (RTP) sessions. It processes sequences of packets from network interfaces or pcap files, producing output files suitable for analysis with tools such as Wireshark/tshark, SoX, or text processing utilities like grep, awk, cut, cat, and sed. The tool operates independently of signaling protocols like SIP, H.323, or SCCP, and does not require RTCP packets, making it versatile for RTP traffic inspection.

Use cases include VoIP traffic analysis, reconstruction of audio streams from captured packets, and investigation of RTP-based communications in wireless networks (supporting AP_DLT_IEEE802_11). It fills gaps caused by lost packets and supports promiscuous mode sniffing for comprehensive capture. Output includes RTP raw dumps, pcap dumps, and noise packets, enabling detailed forensic examination of sessions.

The tool is particularly useful in network security contexts where RTP traffic needs to be dissected without prior knowledge of session parameters, providing flexibility through various filtering and expectation options for ports, payload types, and lengths.

rtpbreak reads packets from a pcap file (-r) or live network interface (-i), optionally forcing datalink header length (-L). It identifies RTP sessions based on UDP ports, payload types (-y), lengths (-l), and timeouts (-t, -T), with options for even ports (-e), unprivileged ports (-u), and pcap filters (-p). Sessions are reconstructed by filling gaps in sequences (-g), dumping raw RTP data unless disabled (-w), pcap dumps unless disabled (-W), and noise packets (-n). Output is saved to a specified directory (-d), supporting promiscuous mode (-m) for broad capture. It works without RTCP and across signaling protocols, handling wireless links.