HiPPIE - Real-Time Streaming Protocol

Protocols > Real-Time Streaming Protocol

HiPPIE Name: rtsp
Protocol Category: Multimedia Protocols
Protocol Classification: Full - Full Prediction

RTSP, or the Real Time Streaming Protocol, is a protocol designed to be able to reliably transport streaming media around that, be it video or audio. It does deal with codecs specifically, as that is handled by the clients. RTSP uses a TCP connection (commonly on port 554 for RealNetworks applications and port 1755 for WindowsMedia applications) to handle flow control and session establishment, while all actual streaming occurs over UDP. This creates an interesting problem that is solved rather easily with HiPPIE. Like some other standard protocols that operate in this manner (such as FTP or IRC), you must use prediction techniques to know that the secondary connection is going to be established and pre-classify it.

TCP Control Session

The TCP control sessions for RTSP connections are very readily identified. They operate in a very similar structure to that of HTTP and many other protocols in that they follow a command|protocol structure. This is displayed below:

Based on this information, and armed with a list of commands (provided below), you can reliably recognize the initiations of connections over RTSP.

RTSP Commands

OPTIONS
DESCRIBE
ANNOUNCE
PLAY
SETUP
GET_PARAMETER
SET_PARAMETER
TEARDOWN

Predicting UDP Sessions

This is where recognizing protocols becomes more than just childs play. Before establishing UDP streaming sessions, the TCP control channel will use some specific commands to establish just what port(s) these connections will occur on. The client will issue a SETUP command and offer to the server its port numbers to which the server may start throwing data. You could predict connections from any port from the server to each of those ports. However, there is even a more concise manner to go about this. After the server receives this data, in order to confirm it with the client, the server will respond in kind with a packet that contains these certain pieces offered below in order.

RTSP/1.0 200 OK

followed by at some point:

Transport:

However, determining how these connections should be predicted is also tricky, as some of the streaming companies will initiate the connection from the server side, while others initiate from the client side. The trick to determining this is to determine the order of the following two parameters also provided.

client_port=<port number or port1-port2>

server_port=<port number or port1-port2>

If these come in the order of server_port, client_port, this is typically WindowsMedia, and the connection will be initiated by the server. However, if these come in the order of client_port, server_port, it typically is RealMedia, in which case the connection is initiated by the client. If you follow these rules to predict connections of the type RTSP, you have successfully identified the external UDP connections.

Back to Protocol List.