This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Need way to save http video stream bytes to a file…

0

Using Wireshark Version 1.12.7 on Windows, after capture of UDP video stream packets, saving the video to a file may be done by:

  1. Right-click on a video packet, and select "Follow UDP stream"
  2. When the dialog appears, click the "Save As" button, and name the file with a .ts extension

After doing so, the .ts file may be opened in VLC.

My question: Is there a way to accomplish the equivalent on a capture of http video stream? This DOESN'T work:

  1. Right-click on a video packet, and select "Follow TCP stream"
  2. When the dialog appears, click the "Save As" button, and name the file with a .ts extension

asked 29 Sep '15, 17:45

mfbaker's gravatar image

mfbaker
16448
accept rate: 0%

Couleur you provide us an example trace of the TCP case, in a public accessible place ?

(30 Sep '15, 04:15) Christian_R

Yes, here's an example capture of an http video stream: https://drive.google.com/file/d/0B1O8tPh9Cozjd1BFTzFzRWdhNGs/view?usp=sharing

When you click the link, a page will appear with a download button. Upon clicking the button, it should save as a file named "20150930_httpVideoStream.pcapng".

Thanks! -Mike

(30 Sep '15, 18:16) mfbaker

I was able to extract the video stream and play it, but there wasn't any audio. Was there audio in the original stream, or it was video only? If there wasn't any audio, then my procedure worked and I will post it. If there was audio, it wasn't present when I extracted the stream.

(30 Sep '15, 18:51) Jim Aragon

Thanks much, Jim! The capture I posted had no audio, so yes, please post your procedure.

Tomorrow I will try to post another capture with audio, just to make sure that will work, too.

-Mike

(30 Sep '15, 19:25) mfbaker

One Answer:

1

Go to Edit > Preferences > Protocols > TCP. Enable "Allow subdissector to reassemble TCP streams." Then go to File > Export Objects > HTTP. Select the video stream, then click on "Save As" and save with an appropriate extension, .ts in the case of the stream extracted from the capture file you supplied.

answered 30 Sep '15, 19:37

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Thank you very much, Jim -- your procedure worked! Wow, wireshark has such an amazingly number of capabilities -- kudos also to the wireshark developers!

(30 Sep '15, 21:20) mfbaker

Jim, just to follow up, I confirmed that "File -> Export Objects -> HTTP" on a http video stream with audio also worked great -- thanks again!

(02 Oct '15, 10:04) mfbaker