1
votes

I'm working on project at university. What I'm trying to do is that I want my program to be able to change bits in RTP packets' payload. I'm trying to create a simple tool that would apply steganography on RTP packets' payload - first it would "catch" rtp packets sent from my computer, then change payload section and send packets further to destination. First thing (while learning) what I'm trying to do is to create RTP packet stream. And i thought I managed, until I checked with Wireshark:

enter image description here

All that we see is only UDP packets (python socket.SOCK_DGRAM)

enter image description here And just simple data stream of bits..

I'm trying to create packet by the RCF 3550:

  • Version - 2 bits;
  • padding - 1 bit;
  • extension - 1 bit;
  • csrc_count - 4bits;
  • marker - 1 bit;
  • payload_type - 7 bits;
  • sequence_number - 16 bits;
  • timestamp - 32 bits;
  • ssrc - 32 bits;
  • payload - varies;

I'm creating a list of bits:

    rtp_packet[0:2] = format(packet_data["version"], "b").zfill(2)
    rtp_packet[2:3] = format(packet_data["padding"], "b")
    rtp_packet[3:4] = format(packet_data["extension"], "b")
    rtp_packet[4:8] = format(packet_datas["csrc_count"], "b").zfill(4)
    rtp_packet[8:9] = format(packet_data["marker"], "b")
    rtp_packet[9:16] = format(packet_data["payload_type"], "b").zfill(7)
    rtp_packet[16:32] = format(packet_data["sequence_number"], "b").zfill(16)
    rtp_packet[32:64] = format(packet_datas["timestamp"], "b").zfill(32) # turi dideti po 160
    rtp_packet[64:96] = format(packet_data["ssrc"], "b").zfill(32)
    rtp_packet[96:128] = format(packet_data["csrc_list"], "b").zfill(32)
    rtp_packet[128:] = bin(int.from_bytes(packet_data["payload"].encode(), "big"))[2:]

And then send those bytes through created socket. Didin't work (the result is above). Then I found this PyRTP library and the result is the same as above.

I'm new in Python and all this packet thing, so maybe someone could help me with what I'm doing wrong or what I didn't do that Wireshark still sees those packets as only UDP, but not RTP? Image below is what I hope to do (this was done with a SIP server at home). Thank you in advance!

enter image description here enter image description here

1
afaik RTP is encapsulated into UDP packets enter image description hereVictor

1 Answers

1
votes

RTP is an application protocol and it's encapsulated into UDP (network protocol), you can verify that your packets are RTP packets using WireShark with the following: https://en.wikiversity.org/wiki/Wireshark/IPv4_multicast