Search code examples
wiresharkpcapmpegmpeg2-ts

Extract Mpeg TS from Wireshark

I need to extract a MPEG-TS stream from a Wireshark capture. I have managed to do this but when I play it back using VLC the output is crappy, it's just a green window with some jitter on the top rows.

Here is how I did it:

  1. Captured using ip.dest filter for the multicast stream.
  2. Analyze -> Decode As -> UDP port (field), portnumber (value), MP2T (current)
  3. Tools Dump MPEG TS Packets.

It does not play out correctly. Is there any other way of doing this

Solution

  • When I need to dump TS from a pcap file I do following:

    1. If TS in plain UDP (column protocol shows MPEG TS for each packet) jump to step 3
    2. If TS is packed in RTP, right click on any packet -> Decode as -> Choose RTP under field "Current"
    3. Use tool MPEG Dump, Tools -> Dump MPEG TS Packets

    I do not use MP2T packets decoding, it usually doesn't work.

    If the TS is in plain UDP, it can happen that TS packets are shuffled and 4 bits long TS packet field which serves as a continuity counter is not long enough to correctly order TS packets. This can result in corrupted playback of dumped TS.