I was streaming an mp3 song from server to client while capturing traffic on the client. So I've got a pcap with the only one RTP stream: https://d.pr/Jfah The problem is that I can't play it in Wireshark. Why isn't it playable? When I was streaming the audio, I was saving the stream on the client side via VLC - and there's nothing wrong with the file itself, it can be played apart. But Wireshark can't play the same audio from captured pcap... asked 13 Nov '16, 14:39  trixter |
One Answer:
Wireshark doesn't stream the payload (contents) extracted from RTP to an external player but it plays it on its own, using a sound device as an output. It means that it has to be able to decode the payload, and it currently is able to decode only PCMA and PCMU codecs. For any other codec, you have to save the payload to a file and use an external player to play that file. For CBR (constant bit rate) codecs, or for VBR codecs which carry the information about frame boundaries inside the payload, such as MP3, this can be done using For those VBR codecs where information about the beginning and end of each packet is not part of the codec payload itself because they expect this information to be conveyed by a generic transport layer, such as Opus, you have to use some other tool to extract both the payload and the information about the packet borders from the capture file and save it in ogg or matroska file format, which both constitute a framework for various VBR codecs. There is another Question here which deals with this task in deeper detail. answered 14 Nov '16, 00:17  sindy edited 15 Nov '16, 05:39 |
Thanks, it works :) The only weird thing is the resulting file is playable only via QuickTime: VLC and iTunes are not playing it...
That sounds weird, as according to the specification, no file header is necessary for the player to handle the mp3 contents.
Can you compare the original file from the server with the file obtained from the RTP? Maybe the header of the very first frame is lost in transit and the players are unable to synchronize? Besides, I've seen lost packets on your screenshot, so it may be that those players prefer not to play the file with drop-outs so they better don't play it at all...