This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Using Wireshark Version 1.12.7 on Windows, after capture of UDP video stream packets, saving the video to a file may be done by:

  1. Right-click on a video packet, and select "Follow UDP stream"
  2. When the dialog appears, click the "Save As" button, and name the file with a .ts extension

After doing so, the .ts file may be opened in VLC.

My question: Is there a way to accomplish the equivalent on a capture of http video stream? This DOESN'T work:

  1. Right-click on a video packet, and select "Follow TCP stream"
  2. When the dialog appears, click the "Save As" button, and name the file with a .ts extension

asked 29 Sep '15, 17:45

mfbaker's gravatar image

mfbaker
16448
accept rate: 0%

Couleur you provide us an example trace of the TCP case, in a public accessible place ?

(30 Sep '15, 04:15) Christian_R

Yes, here's an example capture of an http video stream: https://drive.google.com/file/d/0B1O8tPh9Cozjd1BFTzFzRWdhNGs/view?usp=sharing

When you click the link, a page will appear with a download button. Upon clicking the button, it should save as a file named "20150930_httpVideoStream.pcapng".

Thanks! -Mike

(30 Sep '15, 18:16) mfbaker

I was able to extract the video stream and play it, but there wasn't any audio. Was there audio in the original stream, or it was video only? If there wasn't any audio, then my procedure worked and I will post it. If there was audio, it wasn't present when I extracted the stream.

(30 Sep '15, 18:51) Jim Aragon

Thanks much, Jim! The capture I posted had no audio, so yes, please post your procedure.

Tomorrow I will try to post another capture with audio, just to make sure that will work, too.

-Mike

(30 Sep '15, 19:25) mfbaker

Go to Edit > Preferences > Protocols > TCP. Enable "Allow subdissector to reassemble TCP streams." Then go to File > Export Objects > HTTP. Select the video stream, then click on "Save As" and save with an appropriate extension, .ts in the case of the stream extracted from the capture file you supplied.

permanent link

answered 30 Sep '15, 19:37

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Thank you very much, Jim -- your procedure worked! Wow, wireshark has such an amazingly number of capabilities -- kudos also to the wireshark developers!

(30 Sep '15, 21:20) mfbaker

Jim, just to follow up, I confirmed that "File -> Export Objects -> HTTP" on a http video stream with audio also worked great -- thanks again!

(02 Oct '15, 10:04) mfbaker
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×293
×42
×12
×6

question asked: 29 Sep '15, 17:45

question was seen: 5,872 times

last updated: 02 Oct '15, 10:04

p​o​w​e​r​e​d by O​S​Q​A