This is our old Q&A Site. Please post any new questions and answers at


I receive a h264 bytestream via rtp. To analyze the stream in wireshark, I set the protocol (rtp) and the decoding options (h264 dynamic payload type to 96). My problem is, that my stream includes h264 startcodes (0x00000001) before nal header types. The fist byte of the startcode wireshark parses as nal unit header and of course detects an undefined type.

Can anyone help me to find out a filter that ignores the first 4 bytes of the h.264 payload or parse the h264 stream correct as byetestream separated with startcodes?

Thank you, janina

asked 22 Aug '17, 22:01

janina's gravatar image

accept rate: 0%

That looks as if there's either a bug in the H.264 dissector or the byte stream is somehow invalid. Could you file a bug on the Wireshark Bugzilla, and attach a capture that demonstrates the problem?

permanent link

answered 23 Aug '17, 14:24

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Thank you for your answer. I don't think that its a bug from wireshark. Rather I didn't quite understand something. Nobody else has a problem like me and I coded the whole video pipeline. I will elucidate my setup. I have written a small programm that gets a video stream from a Logitech C920 webcam and sends it to a server. I get the raw h264 bytestream from the cam and pack the frames into simple 12byte-header rtp packets (without optional extensions). This is the video I'm monitoring. In the stream you see a sps, pps followed by an idr frame. Is it a regular H264 stream if I send the Bytestream with startcodes via rtp? Or is this format not specified? Should I really write a bug ticket?

(24 Aug '17, 00:14) janina

From the code it seems like when calling the h264 dissector directly it does not take the start code into account. But dissect_h264_nal_unit() does. I'm not sure if your format is "legal" e.g according to RFC specification of H.264 over RTP. If you remove the start code in your script, it should work.

(24 Aug '17, 04:00) Anders ♦

As an alternative it might be possible to write a LUA script to handle your format e.g skip the start code befor calling the h264 decoder.

(24 Aug '17, 04:02) Anders ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Aug '17, 22:01

question was seen: 2,251 times

last updated: 24 Aug '17, 05:28

p​o​w​e​r​e​d by O​S​Q​A