Analysis

An RTSP conversation should consist of TCP flows corresponding to the RTSP control connection. There should be two flows, one in each direction, from client to server and from server to client:

TCP            1.1.1.3:58795 ->        2.2.2.2:554   Watch    I               7

TCP            2.2.2.2:554   ->        1.1.1.3:58795 Watch    O               5

• The RTSP control connection for the initiator flow is sent from destination port 554.
• The RTSP control connection for the responder flow is sent from source port 554.

The UDP flows correspond to RTP media sent over the RTSP connection.