This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Sniffing and playing a video stream

0

New user here. Hopefully I'm in the right place.

I'm trying to send a unicast udp video stream from a Raspberry pi to a Windows server. The server will do two things. It will forward the stream and it will optionally let a person logged into the server view the stream. I can accomplish both of those tasks fairly easily with Windows versions of netcat and mplayer. However, I'm having a major difficulty doing both at the same time.

So right now I have the following command working great:

ncat -u -l -p 5000 | mplayer -fps 60 -cache 1024 -vo direct3d -

Similarly I will also want to use netcat to forward the stream. But, I can't have two netcat processes listen on the same port. Then I figured out I could use socat to multicast and then use another socat to listen to the multicast and do two unicasts, but that's a bit kludgy and my video ended up garbled.

Doing more research led me to trying to find a command line tool to mirror ports on the server. While researching this, I read about tcpdump, windump, tshark, and wireshark. I thought why mirror a port when I really could just sniff packets.

My hope was to sniff packets coming into port 5000 and pipe those off to mplayer. And at the same time, run netcat to forward the packets to the final destination. I started testing just the mplayer functionality. Unfortunately the video is quite garbled. Since I'm pretty new to tshark, I was hoping I could get some pointers. Here's what I'm trying:

tshark -i 1 -p -q -s 0 -w - udp port 5000

And I'm piping that to my mplayer command listed earlier. When testing this kind of thing with windump, I also got garbled video. But I wonder if that's because the windump (and maybe tshark) output is more than just the raw bytes? Or maybe something else is going on here? Should I go back to researching a port mirroring tool?

asked 01 Mar '15, 21:57

DanU's gravatar image

DanU
11114
accept rate: 0%


One Answer:

1

Yes, it is more than just the raw bytes. It contains all things PCAP, which is to say datalink meta data and per packet meta data. And then the full network frame used to transport your bytes. Indeed a 'port mirror tool' would be better than these analysis tools.

answered 02 Mar '15, 03:53

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks for the response. I'll head my research in that direction.

(02 Mar '15, 08:00) DanU