Open the Wireshark capture and use the Telephony menu to navigate to RTP | RTP Streams, as shown in the following screenshot:

Selecting the preceding option will list all the RTP streams in a new pop-up window, as shown here:

Each RTP stream will be listed in the following format:

• Source Address: The source IP address of the RTP stream endpoint. This can be IP Phone or a teleconference unit.
• Source Port: Source port of the UDP header. The session originator uses a locally unique random port as the source port.
• Destination Address: The destination IP address of the RTP stream endpoint.
• Destination port: The destination port of the UDP header. The session originator uses one of the ports from the RTP port range as the destination port. RTP uses a broad range of UDP ports to support concurrent calls. The port range is from 16384 to 32767.
• SSRC: Synchronization Source, which is an RTP stream identifier.
• Payload: RTP payload that defines the codec type used for the stream.
• Additional Stream Data: Additional details including the number of packets captured for each stream, lost packets, jitter/delay details, and so on.

Select the relevant stream from the pop-up window or use the follow the stream option:

These are explained as follows:

• This was the screenshot of an RTP packet. Wireshark will highlight the packet number of the signaling protocol that setup this RTP packet.
• The payload field of RTP packet will describe the audio codec used. In the preceding packet, G711 is used as the audio codec.
• Each RTP packet will be included with a sequence number that will sequentially increment by 1 for each subsequent packets.
• RTP packet also carries the timestamp from the endpoint.
• The Sequence number and timestamp are used to measure the quality of service.