topic Re: RTP traffic doesn't show in the logs in General Topics

RTP traffic doesn't show in the logs

trsantos — Wed, 05 Mar 2025 00:13:29 GMT

Hi people,

We have a CCTV system in the company and I'm analysing this communication in the checkpoint, but I can't see any RTP packets flowing through the gateways. I can see the RTSP (control packets) traffic when the camera is initializing but can't see subsequent RTP traffic (the real stream) coming afterwards. I already checked the specific rule for this traffic, and it set to log it, however I can only see this traffic on Wireshark capturing in the local machine. I'm assuming the traffic like this (stream) is not logged by default, as it doesn't make sense to log every packet of stream for every camera.

Is there any hidden option to enable this log? maybe something specific for UDP/stream?

Re: RTP traffic doesn't show in the logs

PhoneBoy — Wed, 05 Mar 2025 13:48:15 GMT

What services are you using in your rules to allow the traffic?

Re: RTP traffic doesn't show in the logs

trsantos — Thu, 06 Mar 2025 04:06:32 GMT

We are using "Any" for this particular traffic, and I can only see this rule logging rtsp on tcp/554, although I can see the higher ports (50004 on this specific case, it uses dynamic ports) via fw monitor.

Re: RTP traffic doesn't show in the logs

PhoneBoy — Fri, 07 Mar 2025 00:09:40 GMT

RTSP is a "Match for Any" service, which is why it's being used.
I assume it is not logging the data stream by design, but TAC would have to to confirm.

Not sure there's an option in this service to enable logging the data stream, but you can disable this service (and handler) from being matched by opening up the service and unchecking the "match for any" option.