CLI or script for “Follow udp stream”?

Question

I have many .pcap files of video multicast. To strip off the network info and keep just the video data, I have been manually doing the "Follow UDP stream" command, then saving those results as "raw" transport stream (.ts) files. The problem is that this is a very long process (>15 min per 250Meg file).

I have the proper filter needed to get just the frames I want from the .pcap files and can launch them from the CLI. My question is whether or not there is a method to do the "Follow UDP stream" part via CLI or script. If so, pointers or suggestions are GREATLY appreciated.

Thanks, Dave T.

Answer 1

Have a look at the discussion at http://www.wireshark.org/lists/wireshark-users/200611/msg00133.html, it contains a little script I wrote that might help you out:

#!/usr/bin/perl -w
Just a little script written by Sake Blok ([email protected])
to extract udp-payload data from an udp-stream.
use strict;
use English;
use Net::PcapUtils;
use NetPacket::Ethernet qw(:strip);
use NetPacket::IP;
use NetPacket::UDP;
my $packet_nr=0;
sub process_pkt {
my($arg, $hdr, $pkt) = @_;
my $ip_obj = NetPacket::IP->decode(eth_strip($pkt));
my $udp_obj = NetPacket::UDP->decode($ip_obj->{data});
$packet_nr++;
printf OUT "%s",$udp_obj->{data};
}
my $infile = shift || die "Usage: $0 <infile> <outfile>\n";
my $outfile = shift || die "Usage: $0 <infile> <outfile>\n";
open(OUT,">$outfile");
Net::PcapUtils::loop(&amp;process_pkt, (SAVEFILE => $infile, FILTER => 'udp'));
close(OUT);