Extract Mpeg TS from Wireshark

Question

I need to extract a MPEG-TS stream from a Wireshark capture. I have managed to do this but when I play it back using VLC the output is crappy, it's just a green window with some jitter on the top rows.

Here is how I did it:

1. Captured using ip.dest filter for the multicast stream.
2. Analyze -> Decode As -> UDP port (field), portnumber (value), MP2T (current)
3. Tools Dump MPEG TS Packets.

It does not play out correctly. Is there any other way of doing this

Answer 1

When I need to dump TS from a pcap file I do following:

1. If TS in plain UDP (column protocol shows MPEG TS for each packet) jump to step 3
2. If TS is packed in RTP, right click on any packet -> Decode as -> Choose RTP under field "Current"
3. Use tool MPEG Dump, Tools -> Dump MPEG TS Packets

I do not use MP2T packets decoding, it usually doesn't work.

If the TS is in plain UDP, it can happen that TS packets are shuffled and 4 bits long TS packet field which serves as a continuity counter is not long enough to correctly order TS packets. This can result in corrupted playback of dumped TS.

Answer 2

Added two filtering options to the original pcap2mpeg.

So you can filter:

• by udp destination port
• by multicast group IP and destination port

This is important for cases where the captured file has multiple TS on the same IP but on different ports, or, on different mcast IP's.

perl source code version:

You can find it on: https://github.com/bugre/pcap2mpegts

you would run it as:

pcap2mpegts.pl -y -i 239.100.0.1 -p 2000 \
               -l multi_ts_capture.pcap  \
               -o single-stream-output.ts

---

docker/container version:

Had to extract transport stream from a PCAP capture again, but wasn't willing to install perl and the dependencies, and with the wide availability of containers (docker), decided to generate a container image....Why not?

You could use it as:

## let's say you have a 'mycapture.pcap' at this folder

docker run --rm -v $PWD:/inout bugre/pcap2mpegts \
      --yes                                      \
      --logfile /inout/mycapture.pcap            \
      --outfile /inout/mycapture.ts