CODEWITHSUNDEEP
unixwiresharkpcaptshark
ibtissem
ibtissem

Reputation: 51

tshark: extract rtp payload of the codec G.723

In order to extract the RTP payload from a pcap file captured by wireshark, I'm using tshark with the command

tshark -nr stream.pcap -i wlan1 -R 'rtp && ip.dst==192.168.1.64' -T fields -e rtp.payload

this succeeded with the codecs g.729 and ilbc but with the codec g.723 it wasn't the case. I think that this problem is due to the fact that the field payload of the rtp protocol doesn't exist any more (when consulting the wireshark).

Any idea of how to extract the payload of the codec g.723?

Upvotes: 0

Views: 2063

Answers (2)

stimur
stimur

Reputation: 265

I did it this way: used rtpxtract.pl from here

then used ffmpeg to convert it to format user can listen to. like MP3.

ffmpeg -f g723_1 -i ${infile} ${outfile}.mp3

Upvotes: 1

ibtissem
ibtissem

Reputation: 51

to solve this problem you have just to disable the protocol g723 in wireshark in the item Enabled Protocols from the Analyze menu then the field "payload" will appear in the protocol rtp and the command 

tshark -nr stream.pcap -i wlan1 -R 'rtp && ip.dst==192.168.1.64' -T fields -e rtp.payload

will succeed!

Upvotes: 0

Related Questions