This is our old Q&A Site. Please post any new questions and answers at

I was streaming an mp3 song from server to client while capturing traffic on the client. So I've got a pcap with the only one RTP stream: The problem is that I can't play it in Wireshark.

Why isn't it playable? When I was streaming the audio, I was saving the stream on the client side via VLC - and there's nothing wrong with the file itself, it can be played apart. But Wireshark can't play the same audio from captured pcap...

asked 13 Nov '16, 14:39

trixter's gravatar image

accept rate: 0%

Wireshark doesn't stream the payload (contents) extracted from RTP to an external player but it plays it on its own, using a sound device as an output. It means that it has to be able to decode the payload, and it currently is able to decode only PCMA and PCMU codecs.

For any other codec, you have to save the payload to a file and use an external player to play that file. For CBR (constant bit rate) codecs, or for VBR codecs which carry the information about frame boundaries inside the payload, such as MP3, this can be done using Save payload -> raw in Wireshark (so you may stop reading here as you are interested in MP3).

For those VBR codecs where information about the beginning and end of each packet is not part of the codec payload itself because they expect this information to be conveyed by a generic transport layer, such as Opus, you have to use some other tool to extract both the payload and the information about the packet borders from the capture file and save it in ogg or matroska file format, which both constitute a framework for various VBR codecs. There is another Question here which deals with this task in deeper detail.

permanent link

answered 14 Nov '16, 00:17

sindy's gravatar image

accept rate: 24%

edited 15 Nov '16, 05:39

Thanks, it works :) The only weird thing is the resulting file is playable only via QuickTime: VLC and iTunes are not playing it...

(14 Nov '16, 09:48) trixter

VLC and iTunes are not playing it...

That sounds weird, as according to the specification, no file header is necessary for the player to handle the mp3 contents.

Can you compare the original file from the server with the file obtained from the RTP? Maybe the header of the very first frame is lost in transit and the players are unable to synchronize? Besides, I've seen lost packets on your screenshot, so it may be that those players prefer not to play the file with drop-outs so they better don't play it at all...

(14 Nov '16, 09:58) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 13 Nov '16, 14:39

question was seen: 2,071 times

last updated: 15 Nov '16, 05:39

p​o​w​e​r​e​d by O​S​Q​A