Can we have two simultaneous udp streams between 2 specific pairs of IPs and Ports?

Question

I'm trying to inspect and analyze my network traffic. Suddenly I found something confusing. I was thought that packets are splited to streams based on their (SRC_IP, DES_IP, SRC_PORT, SRC_PORT , PROTOCOL_NUM). But now I found two groups of packets with equal above features but interpreted as two different streams in Wireshark:

As you see below, the RTP packets with even packet numbers are a single stream and the RTP packets with odd packet number are another stream, while both has equal (SRC_IP, DES_IP, SRC_PORT, SRC_PORT , PROTOCOL_NUM). Why?

To compare the statistics:

They are interpreted as two different streams:

Matilda

Answer 1

You are just looking at the UDP traffic from either direction. UDP stream 2 is from 192.168.1.162 to 192.168.1.159 and UDP stream 3 is from 192.168.1.159 to 192.168.1.162.

While there are two UDP streams, there is only one RTP session. This is because the RFC protocol states that you cannot multiplex on the same port. From RTP RFC Section 5.2.

In RTP, multiplexing is provided by the destination transport address
(network address and port number) which is different for each RTP session.

So, yes there are two simultaneous UDP streams, but it is just both hosts talking to each other during a RTP session.

Shetler