volvet/h264extractor

wireshark plugin to extract h264 or opus stream from rtp packets

H264extractor

Wireshark plugin to extract h264 stream from rtp packets, support Single NAL Unit Mode(RTP Packetization Mode 0), FU-A and STAP-A. In addition, opus stream is supported as well.

How to use h264extractor

• Copy rtp_h264_extractor.lua to the directory where wireshark was installed
• edit init.lua, make sure "disable_lua = false" and add "dofile(DATA_DIR.."rtp_h264_extractor.lua")"
• when open pcap file in wireshark, decode as RTP and configure the H264 dynamic payload types.
• Menu - Tools - Extract h264 stream from RTP

How to use opus extractor

• Copy rtp_opus_extractor.lua to the directory where wireshark was installed
• edit init.lua, make sure "disable_lua = false" and add "dofile(DATA_DIR.."rtp_opus_extractor.lua")"
• when open pcap file in wireshark, decode as RTP.
• Menu - Tools - Extract opus stream from RTP

Good tutorials

• https://blog.networkcentric.org/wireshark-h264-video-decoding/

Reference

• https://wiki.wireshark.org/Lua
• https://tools.ietf.org/html/rfc6184
• https://tools.ietf.org/html/rfc7587
• https://tools.ietf.org/html/rfc7798

h264extractor's Issues

Distortion in h264 video

hi, i have a h264 video stream over RTP. i use wireshark plugin(lua) to extract this h264, but after extraction the video does not play correctly, (Distortion in video).can any one help me?

Add a LICENSE

As this is a derivative work of Wireshark, GPL2/3 is recommended here.

Tap missing GUI filter

Tap from listener is missing current displayed GUI filter

rtp_h264_extractor.lua#L30
rtp_opus_extractor.lua#L29

Error on attempt to extract with WS on macOS

Catching this error:

I admit I could not follow your install instructions:

* Copy rtp_h264_extractor.lua to the directory where wireshark was installed
* edit init.lua,  make sure "disable_lua = false" and add "dofile(DATA_DIR.."rtp_h264_extractor.lua")"
* when open pcap file in wireshark,  decode as RTP and configure the H264 dynamic payload types.  
* Menu - Tools - Extract h264 stream from RTP

I was just able to copy the *.lua to /Applications/Wireshark.app/Contents/PlugIns/wireshark/ as suggested by WS: https://www.wireshark.org/docs/wsug_html_chunked/ChPluginFolders.html

Could not find "init.lua" there...

dump.264 too many masaike

when the camera is moving, too many masaike , and rtsp player all fine

Could not work on Mac

It's a great tool. I had tried it on Windows and Mac. It works well on Windows, but has issue on Mac.
I use it to extract 264 bitstream, and report follows issue on Mac:

Lua: on packet 51 Error During execution of Listener Packet Callback:
...nts/Resources/share/wireshark/rtp_h264_extractor.lua:58: attempt to call method 'raw' (a nil value)

the WireShark version is 1.10.6.

Error of not able to open dump file

Lua: Error During execution of Menu Callback:
[string "/Users/sijchen/.wireshark/plugins/rtp_h264_ex..."]:40: attempt to call global 'log' (a nil value)

Ln40: log("open dump file fail")

Error of loading rtp_h264_extractor.lua

Hi,
I get an error when I try to reload the lua plugins: "Lua: Error during loading: rtp_h264_extractor.lua:7: unexpected symbol near '<' "
Any ideas how to solve it?

Thanks!

Adjust this code to h265 please

Could not play exported OPUS file

You have created very nice tool.
However I was not able to play or convert received OPUS file
I have tried to use tools from http://www.opus-codec.org/ but It do not recognize file as opus.
OPUS file is attached

dump.zip

Fail to extract h264 from some pcap file

I get packets using wireshark, but can't extract h264 from it. Please fix it.

Lua script doesn't extract dump file using tshark

I want to run lua script from command line with tshark.

When I run tshark -X lua_script:rtp_h264_extractor.lua -r a.pcap on ubuntu terminal, it produces output that I expect but it doesn't create dump file.

Are there any solution for this problem? Thanks.

ERROR: payloadTable size is 0, seqTable size is 1

I have a pcap file which one has payload with video coded with h.264
Wireshark, with its option to "analyze->decode as->RTP" shows that has MPEG-TS payload but when use "Tools->Extract opus stream from RTP" or "Tools->Extract opus stream from RTP" just said

ERROR: payloadTable size is 0, seqTable size is 1

or

Start
phase 1
phase 2: max_packet_count = 0
End

We are using VLC player to transmit video.
Is there an specific configuration about codec in order that h264extractor works?

can't work in Ubuntu wireshark

get the error message:

Lua: on packet 19377 Error during execution of Listener packet callback:
/usr/share/wireshark/rtp_h264_extractor.lua:76: attempt to index upvalue 'fp' (a nil value)

Not filtering any packet

I need to change
local h264_tap = Listener.new("ip")
to
local h264_tap = Listener.new(tap, "h264")
to get it work.
(Must decode UDP as RTP and set H264 payload type first)
I don't know why...

How Do I Use Tshark?

tshark -X lua_script:rtp_h264_extractor.lua -r H264.pcapng
but don't Generating H264 file