How to identify RTP ports ?

[aghazi]

My customer is interested in blocking the RTP traffic sourced from any VoIP application. Any idea, how to identify the ports used by RTP.

I understand that when a router receives a (voice over) IP packet from its peer, it can identify a UDP datagram by looking at the protocol field of the IP packet. What I don’t understand is that how the receiving router will identify (by looking at the UDP port numbers) that the receiving UDP datagram actually consists of RTP traffic.

thanks,

Ahmer Ghazi

[gstegmann]

hi.

blocking all udp traffic with udp-ports greater than or equal to 16384 on both ends will certainly block all rdp-traffic. but it will likely block other applications too, that use these combinations.

rdp-packets are "inside" the udp-packets, so there is another header :

IP

|--UDP

|--RDP

you can figure that out by using a network monitor or a sniffer.

[mhayek]

In order to identify Cisco VOIP(RTP and RTCP) packets, look for UDP ports in this range: 16383 - 32767 with an access list, and then deny it.

It could look something like this:

access-list deny udp any any range 16383 32767