<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Clint -- The answer to this is fairly straightforward. <br>
<i><br>
</i><i>If</i> your Empirix Hammer is providing media quality
monitoring, it <i>must</i> rely on the the actual RTP media stream
that it is monitoring. <br>
<br>
A media stream is defined as Source IP:Port plus Destination IP:port
plus <b>SSRC. </b>SSRC is often over overlooked, but strict
media gateways or media relays <i>may</i> refuse to process any
further RTP packets when SSRC or Source IP:port changes without any
new SDP offer-answer. <br>
<br>
RTP Start is established when the the <b>first </b>packet is
received on the <b>Destination</b> IP:port negotiated by SDP
offer:answer. At that time the RTP monitor (or any strict media
handler) <i>learns</i> the <b>Source</b> IP:Port, and the SSRC<br>
<br>
As someone else has pointed out, there is no "RTP end" packet. So
"RTP end" is declared when there are no further media packets
received on the established <br>
stream, defined by Source IP:Port plus Destination IP:port <b>plus</b>
<b>SSRC</b>. This may happen at any time in an established
session. If something "goes wrong" in a media stream, the "RTP
end" <i>may </i>be declared well before any sip method (usually
BYE) which ends the session. This explains why you "have seen
this many times preceeding a BYE - or even without a BYE." Any
"RTP end" which occurs substantially before a BYE <i>without</i> an
almost immediate new "RTP Start" indicates the potential media
failure. If that happens, the media failure may be the root cause
of the BYE. In that case, you may be loosing revenue. <br>
<br>
None of this is in any way related to presence or absence of RTCP. <br>
<br>
Hope this helps. If you would like any further discussion, please
contact me privately.<br>
<br>
Best regards,<br>
<blockquote>Communichanic Consultants, Inc<br>
<a href="mailto:jsr@communichanic.com">John S. Robinson</a>,
President<br>
</blockquote>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 9/12/2012 17:25, Clint Mojzes wrote:<br>
</div>
<blockquote
cite="mid:14631B1FA7965D4E819D53F73A5C82510386FA@ORD2MBX02E.mex05.mlsrvr.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">We are using a tool called Empirix Hammer
to analyze and report on our network traffic. This tool as
uncovered something that it calls “RTP End” and I’m trying to
get a better definition of what it means. I haven’t been able
to find anything online, including RFCs etc. Basically when
the Hammer see this special packet, it is when a phone or
media gateway is tearing down a call. Logically speaking it is
identifying the end of a media stream, but I’m looking for a
technical definition. Can anyone provide any insight?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Clint<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span
style="font-family:"Arial","sans-serif";color:#336699"><o:p> </o:p></span></b></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
VoiceOps mailing list
<a class="moz-txt-link-abbreviated" href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a>
</pre>
</blockquote>
<br>
</body>
</html>