how to discard the first 4 RTP bytes on wireshark captures?

1.1k Views Asked by At

When capturing H460 data on wireshark (on multiplexed mode), wireshark does not parse RTP data correctly. it should discard first 4 bytes on any RTP packet. looking for hints how to do that

Thanks Amit

1

There are 1 best solutions below

0
On

shark (packaged with wireshark) has this functionality built in.

Make sure that wireshark/tshark is in your PATH variable, and open a new command line window if you've just set it. Let me know if you want me to be more clear there.

  • If you want to discard the first 4 packets of rtp data on the fly :

    tcpdump -i eth0 port ! 5060 and dst 192.168.1.101 -T rtp -n -s0 -w- | editcap -F libpcap -C 4 - - | tcpdump -nlvvv -r - -w output.pcap
    
  • For already captured file (capture.pcap):

    tcpdump -r capture.pcap | editcap -F libpcap -C 4 - - | tcpdump -nlvvv -r - -w output.pcap
    

or

editcap capture.pcap output.pcap -C 4

I didn't test these exact examples myself, but I think tshark's "chop" (-C) option might be what you're looking for.