This is a static archive of our old Q&A Site. Please post any new questions and answers at

Extracting AVB Stream from PCAP file and converting in .wav


Hi everybody,

I have a .pcap-file with audio AVB streams (IEEE 1722a protocol). I would like to extract the audio data and put it in a .wav-file so that it can be played by a standard player. So I would first need to cut the payload of the AVB streams out of the .pcap-file (I think that should be easy as the offsets of these payloads can be calculated), then I have to put the different sequences together to one .wav-file (this should also be possible by adding the right header etc.).

Is there something like that existing for AVB streams? Which programming language would you use for that purpose?


asked 16 Feb '16, 06:42

Lumi's gravatar image

accept rate: 0%

One Answer:


As you've stated elsewhere that you've written your own dissector for ieee1722a v14, you should be able to use tshark to dump only the audio data as hex stream, using the appropriate field name as assigned by your dissector both for -Y and -e parameters of tshark (so, if some packets of the aggregated stream carry audio and some don't, you would only dump those with audio). Speculative example as I don't have the details of your dissector:

tshark -r input_file_name -Y my_ieee1722.audiodata -T fields -e my_ieee1722.audiodata > audio_hex

The -e causes all occurrences of the field in the packet to be dumped, separated by comma by default, so for the embedded ieee1722 dissector, -e dumps


for each packet containing six 24-bit samples.

Then, you would use your favourite programming language to post-process that data. Depending on the properties of the audio codec used (block-based or stream-based), it may be enough to compose the output file of a header followed by the data (like wav or au file), or the file may have to be a structured one like ogg if the codec happens to be a block-based one.

I personally prefer au to wav because with au you don't need to know the total size of the audio data in advance, but as codes for only several codec types are defined for its header, it may not be possible for you to use it.

The above is enough only if the player you'll use to play the resulting file is able to handle the codec and your only task is to inform it which codec to use.

answered 16 Feb '16, 07:20

sindy's gravatar image

accept rate: 24%

Thanks sindy for your answer!

Finally I got it. For whom it may interest. I used perl for this project. First to read the pcap file and extract the information that I need (number of channels, sample rate, audio data etc.). I didn't use tshark because I wanted my script to be independet from any other tool. In a second step I built the RIFF-Wave-header, attached the audio data and saved the whole to a wav file. And it works :)

(23 Feb '16, 06:30) Lumi

As you've posted the question at Wireshark Q&A site, it seemed obvious that you wanted to let the Wireshark suite do most of the job.

Therefore, I've changed my original Comment into an Answer. It is up to you whether you consider it useful and so Accept it (using the checkmark) or keep it formally unaccepted.

(23 Feb '16, 06:46) sindy