SharkFest ’19 Europe

Audio and Video
with Wireshark
Supplemental files and Tools
http://www.ikeriri.ne.jp/sharkfest/
and official site later

Megumi Takeshita

Packet Otaku, ikeriri network service#sf19eu#sf19eu •• Palacio
Palacio Estoril
Estoril Hotel,
Hotel, Estoril,
Estoril, Portugal
Portugal •• Nov
Nov 44 -- 88

Megumi Takeshita, ikeriri network service
•
•
•
•
•
•
•

Worked SE/IS at BayNetwork, Nortel
Founder, ikeriri network service co., ltd
Reseller of CACE technologies in 2008
Wrote 10+ books about Wireshark
Instruct Wireshark to JSDF and other company
Reseller of packet capture / wireless tools
One of contributors of Wireshark
Translate Wireshark into Japanese#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Audio and Video with Wireshark
Now we dissect 5 typical audio and video protocols using#1 Live / On demand streaming ( RTMP FLV )#2 HTTP Live streaming (HLS TS)#3 VoIP (SIP/RTP)#4 Surveillance camera (assume port / motion JPEG )#5 Unknown drive recorder(assume port, protocol, codec / rtpdump / ffmpeg)

Trace files/tools www.ikeriri.ne.jp/sharkfest/#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

3Live streaming and streaming video• There are many live or on-demand video services intodays Internet, for example, YouTube, Facebook
Live, TikTok and many others.
• They use ( or used ) RTMP
Real-Time Messaging Protocol
for broadcasting.
• RTMP is derived from Adobe,
and Flash player use them.
• We can download protocol spec
https://www.adobe.com/jp/devnet/rtmp.html#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

RTMP/RTMPT/RTMPS• Plain RTMP uses TCP port 1935, but we use webbrowser to watch the video, so RTMPT (RTMP
Tunneled) is used between web server and browser.
• RTMPS uses HTTPS to encrypt RTMP, is known as
RTMP over SSL/TLS, and is UDP version of RTMP
• Some web service uses different port number.
In those case, check “Try heuristic sub-dissectors
first” in TCP/UDP preference or manually set“Decode As”#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

check “Try heuristic sub-dissectors first”• “Try heuristic sub-dissectors first” means Wireshark
try to assume which application protocol used inapplication layer, and change the dissectors from data.

• Or set manually assign the port by “Decode As…”
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Capture plain RTMP traffic• First, start capturing using dumpcap below
dumpcap -i 3 -f “tcp port 1935" -w rtmp.pcapng• Then, start streaming to open URL
rtmp://fms.105.net/live/rmc1 by VLC player• Stop capturing and open rtmp.pcapng• Note: we need RTMP
connection packet, so
please start capturing
first then play movie#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Open rtmp.pcapng• Wireshark uses “rtmpt” display filter string, because
rtmp is already used for Routing Table MaintenanceProtocol of Apple Talk protocol family.
• Open rtmp.pcapng and set display filter as “rtmpt”#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Handshake of RTMP
• RTMP exchanges 3 packets for handshake after the
TCP connection is created.

• Client sends C0+C1, server responds with
S0+S1+S2, then Client sends C2 to exchange
version and timestamp and confirmation.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Connection of RTMP

• #14 packet
Client sends AMF (Action
Message Format) message
to connect server with tcURL• rtmp://fms.105.net:1935/live,
version, codecs etc.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

• #15 Server responds withwindows Ack Size,
bandwidth, stream
information, chunk size,
and result as AMF format
as “ connection succeeded”#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Playing the stream

•
•
•
•
•

#18 Client creates the stream#20 Server responds with result#23 Client sends play amf message to play ‘rmc1’#25 Server responds with result#27 Server starts playing the stream play('rmc1')#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Streaming Data
Check #363
• Audio and Video data
is divided into small
size and sent by each
Chunk Stream ID• RTMP Body contains
type and codec.
• Flash Player receives
them and play thestream smoothly.

#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Save FLV using RTMDump• RTMPDump is useful when you save video to flv
https://rtmpdump.mplayerhq.hu/
This time we use rtmpdump-2.3-windows.zip• We got the stream information from packet
From #14 connect rtmp://fms.105.net/live/
From #23 play AMF0 Command play('rmc1')• RTMPdump command is below
rtmpdump –r rtmp://fms.105.net/live/rmc1–o ../out.flv#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Playing FLV file

Collecting location and name ofcontents from Wireshark trace,
you can save live or on-demand
streamings to your PC#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

HLS ( HTTP Live Streaming )• The Flash age has been finished, off course there arestill many FLV, but now we live in HTML5 generation.
• Apple may not like Adobe, so iPhone/iPad uses HLS.
https://developer.apple.com/streaming/• HLS, a.k.a. HTTP Live Streaming is an HTTP-based
streaming protocol by Apple. Not only Safari andQuickTime, but Firefox, Microsoft Edge support HLS.
• HLS divides a stream into small HTTP file downloads,
m3u8 extension is used for sending stream andbitrate list. And HLS also supports HTTPS too.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

M3U8 playlist• HLS is so simple mechanism to stream• Distributor creates multiple TS files using stream
segmenter (if live) or file segmenter (if on-demand)• M3U8 playlist contains links to multiple TS file
• Server provides (multiple) m3u8 playlists• Clients choose a M3U8 and play chunked TS file via
HTTP/HTTPS with adequate cache.
m3u8
m3u8playlist
playlist
m3u8 playlist• 1.ts• 1.ts• •2.ts1.ts• 2.ts• •3.ts2.ts….
• 3.ts ….
• 3.ts ….

TS
TS
TS
Mpeg2
TS
Mpeg2
Mpeg2
Mpeg2

#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Test Network Camera Live Streaming• Some Network Camera supports HLS, we try Unifore’s• dumpcap -i 3 -f “host 52.58.71.125 or port 80 or port
8080 or port 8088” –w hls.pcapng• Open live stream with Microsoft Edge, Safari or VLC(Windows version of Chrome and Firefox may not )http://pub-dss-hls.secu100.net:8080/hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

hls.pcapng• Open hls.pcapng and set display filter as http• Statistics > Flow Graph (limit to display filter )#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

HLS Flows(#6/#12)
GET /hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8 HTTP/1.1
・・・
Host: pub-dss-hls.secu100.net:8080
Connection: Keep-Alive
HTTP/1.1 200 OK
Client requests m3u8 Playlist
Server: openresty/1.9.3.1
Date: Mon, 04 Nov 2019 11:26:22 GMT
Content-Type: application/x-mpegURL
Connection: keep-alive
Server responds bandwidth and alternative
KeyCheck: 200000
m3u8 Playlist ( there are multiple m3u8 playlist
content-length: 129
for different bitrate settings )Access-Control-Allow-Origin: *#EXTM3U#EXT-X-STREAM-INF:PROGRAM-ID=1,BANDWIDTH=512000
http://119.3.50.168:8088/hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

HLS Flows (#14 / #16 )GET /hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8 HTTP/1.1
Referer: http://pub-dss-hls.secu100.net:8080/hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8
・・・
Host: pub-dss-hls.secu100.net:8080
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 200 OK
Client requests alternative m3u8 Playlist
Server: openresty/1.9.3.1
Date: Mon, 04 Nov 2019 11:26:24 GMT
Content-Type: application/x-mpegURL
Connection: keep-alive
KeyCheck: 200000
Server responds bandwidth and m3u8
content-length: 129
playlist including links to TS files
Access-Control-Allow-Origin: *#EXTM3U#EXT-X-STREAM-INF:PROGRAM-ID=1,BANDWIDTH=512000
http://119.3.50.168:8088/hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

HLS Flows (#22 / #24 )GET /hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8 HTTP/1.1
Referer: http://pub-dss-hls.secu100.net:8080/hls/01e99576e1e009902e/6b6d2477d1abfdbe/1.m3u8
・・・#EXTM3U
Range: bytes=0Request m3u8 Playlist including#EXT-X-ALLOW-CACHE:NO
Accept-Encoding: gzip, deflatelink to TS files#EXT-X-VERSION:3
Host: 119.3.50.168:8088#EXT-X-MEDIA-SEQUENCE:0
Connection: Keep-Alive
HTTP/1.1 206 Partial Content#EXT-X-TARGETDURATION:2
Cache-Control: no-cache Server: openresty/1.9.3.1#EXTINF:1.990,
Date: Mon, 04 Nov 2019 11:26:26 GMT
1-0.tsContent-Type: application/vnd.apple.mpegurl#EXTINF:1.990,
Content-Length: 183
1-1.tsLast-Modified: Mon, 04 Nov 2019 11:26:26 GMT#EXTINF:1.990,
Connection: keep-alive
1-2.tsETag: "5dc00ae2-b7"#EXTINF:1.990,
Cache-Control: no-cache, no-store, must-revalidate
1-3.tsPragma: no-cache
Expires: 0
Streaming setting information andAccess-Control-Allow-Origin: *actual link to TS files (1-0.ts…)
Content-Range: bytes 0-182/183#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

HLS Flows (#26 / #36 )GET /hls/01e99576e1e009902e/6b6d2477d1abfdbe/1-0.ts HTTP/1.1
・・・
Host: 119.3.50.168:8088
Request to chunked TS file (1-0.ts)
Connection: Keep-Alive
Cache-Control: no-cache
Response to actual chunked TS file (1-0.ts)
HTTP/1.1 206 Partial Content
HTTP body contains MPEG2
Server: openresty/1.9.3.1
Date: Mon, 04 Nov 2019 11:26:27 GMT
Content-Type: video/mp2t
Content-Length: 11468
Last-Modified: Mon, 04 Nov 2019 11:26:23 GMT
Connection: keep-alive
ETag: "5dc00adf-2ccc"
Content-Range: bytes 0-11467/11468#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

mpeg_dump_lua Scripts• There are many usefulscripts, plugins anddissectors to extend
Wireshark functions atwiki.wireshark.org/Tools• mpeg_dump.lua by Ryan
is a useful lua script toremove protocol headersand output mpeg2 stream#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Set up mpeg_packets_dump.lua• Download mpeg_packets_dump.lua from wiki
• Save it in the Wireshark home directory C:¥Program
Files¥Wireshark as "mpeg_packets_dump.lua"• Edit init.lua in the Wireshark home directory and add
the following line: dofile("mpeg_packets_dump.lua")#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Export MPEG2(TS) from HLS• Put scripts into
Wireshark global folder• Edit init.lua• Select Tool> Dump
MPEG TS Packets• Set Output file path andpacket filter if needed
then click OK to export.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Open TS file and check MPEG2• Open TS(MPEG2) file using
Windows Media Player• You can check streaming
video qualities from thetrace file#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

VoIP ( IP Phone )• Voice over IP is used
CarrierInternetwidely in todays internet
network• SIP server is a kind of PBXin VoIP network and media
gateway is used forconnecting former phonesystem with IP network• RTP(Real-time Transport Protocol) and RTCP are used
for transmitting Audio and Video data.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

voip.pcapng• We captured traffic at LAN (IP Phone ) side,

Sender 09065082538@61.196.187.6
Receiver 0000002115@192.168.0.7:506• Open trace file voip.pcapng in Wireshark,
Telephony > VoIP calls to show call
• Choose call and click Flow sequence#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Call Flow
• SIP call starts with INVITE
method, then receives response
code 100 Trying, 180 Ringing,and 200 OK response toconnect.
• Voice data is sent by RTP• SIP call ends with BYE method,
and receives 200 OK response.
• Click INVITE and RTP packets#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

SIP ( Session Initiation Protocol )• Look at #936 INVITE
message sent by UDP• SIP message is similar to
HTTP, consists of header
and body• Each request andresponse have RequestLine and Response code,and many headers.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

RTP ( Real-Time Transport Protocol )• Look at #955 RTP packet
sent by UDP• RTP packets contains
Payload type, Sequencenumber, Timestamp and
SSRC (Synchronization
Source identifier ) andPayload of actual media.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

RTP Player• Back to VoIP Calls, click“Play Stream” to open
RTP Player• We can check RTP
payloads graph withthe symbol of lost jitter,wrong timestamp andinsert silence• We can also listen the quality of audio( Note: this time codec is G.711u)#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Telephony > RTP Streams• Telephony > RTP Streams summarize RTP streams• Shift click to select both streams and click Analyze#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

RTP Stream Analysis• You can check both streams,
SSRC, Delta, Jitter, Skew,
Seq Errors and Drift info.
• Its time to save audio data,
click Save as Synchronizedor Asynchronized stream
as au format.

#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Playing Saved RTP Audio.au• VLC is a free and open
source cross-platform
multimedia player(https://www.videolan.org/vlc)• Open Saved RTP Audio.au
using VLC Player• We can hear someJapanese words…
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Surveillance camera• There are tons of surveillance camerain the world, we can access them via web• Insecam.com( http://www.insecam.com)
is a famous website introducing public
opened surveillance IP camera• You can search cameras by Manufactures,
Country, Places, Cities and so on.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Canon camera in Nagano, Japan• We pick up a Canon surveillance camera at aparking lot in Nagano, Japan.
• Access the camera and capture the packet, andsave as “canon-camera-nagano.pcapng”#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Find the camera port number• Open canon-camera-nagano.pcapng and selectStatistics > Conversation > TCP and UDP tab• Look for the port number that the camera use.

#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Decode TCP 8081 as HTTP

• We find TCP 8081 is the camera port, then assume
the protocol. This time the camera uses HTTPso try
to decode TCP 8081 as HTTP.
• Select packet and right click
to choose “Decode As…” andset 8081 as HTTP
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Check HTTP response and media• Wireshark decode TCP8081 segments as HTTP,
check #15 frame and open HTTP dissector andselect Media Type and right click to “Show Packet
Bytes”#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Export Objects as HTTP
• File>Export Objects> HTTP to export files
to camera folder on
Desktop• There are file lists
grouped by host name,content type, size, filename
• Create a folder and“Save All” to save them
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Change file extension to jpeg
• There are many image/jpeg files in the folder,but all file name is image.cgi%3fs=***• Create new folder movie and copy these files.
• Change file extension to jpeg but there are dot in
the filename, so use for command like thisfor %s in (*.*) do rename "%s" "%s.jpg"#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Create multiple jpeg files to movie• There are many tools to create movie frommultiple jpeg files ( ex. motion jpeg )• Adobe Premier Elements read multiple
numbered JPEG files to create a video clip.
• Some open source tools like Virtual Dub,
CamStudio support to create a movie• In this case, we use ffmpeg to create movie#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Create sequential files of jpeg
• Open explorer and click one of jpeg files and rename
filename to create sequential files. (514 files )•• for /l %i in (1, 1, 514) do ren “camera (%i).jpg"“camera_%i.jpg"#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

ffmpeg (ffmpeg.org)• ffmpeg is GPL tools for recording, converting andplaying video and audio streams. This time we use
ffmpeg-20181208-6b1c4ce-win64-static• There are tons of options (https://ffmpeg.org/ffmpeg.html)#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Create movie from sequential files•

ffmpeg -f image2 -r 30 -i camera_%d.jpg -r 30 -an-vcodec libx264 -pix_fmt yuv420p camera.mp4-f image2 :format image2(jpeg) -r 30 30fps-i source files –an no audio –vcodec libx264(H.264)-pix_fmt yuv420p#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Play video with VLC Player• Open camera.mp4 using
VLC Player• Finally we can get themovie from trace file !!

#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

#9 Unknown Drive Recorder• Many Drive recorders are

made in China or Taiwan.
• They use WiFi to connect
smartphone App to checkthe camera recordings.
• Let’s dissect with Wireshark• Recorder IP :192.168.1.1#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Trace file information• Unknown drive recorder

192.168.1.1• Smartphone of viewer app
192.168.1.101• Open Smartphone App tocheck the video, then I
collect packets using
AirPcap and Wireshark

192.168.1.101#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

192.168.1.1

unknowndriverecorder.pcap• The trace filecontains traffic
between unknown
drive recorder andsmartphone app in
Wi-Fi Channel 9, MCS
7, IEEE802.11n(20MHz)#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

What including tons of small packets
Open trace file unknowndriverecorder.pcapng
We can see many small packets
Sometimes we need to decrypt WPA2 or TLS.
Open small chunk with binary editor, it is lucky if the
chunk is one of graphic file format, we can use thesame way of surveillance camera, but No…
• Port number is usually changed from original.
• In this case, we think about RTP streams
Statistics > Conversation to check UDP stream••••#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Conversation > UDP streams• A multimedia traffic is sent by a few streams.
• Audio and video streams are divided by two in usual.
• Wireshark finds streams below,
192.168.1.1:6970（RDT）→192.168.1.101:1306
192.168.1.1:6971(RTCP)→192.168.1.101:1307
192.168.1.1:6972（DATA）→192.168.1.101:1306
192.168.1.1:6973(RTCP)→192.168.1.101:1307• Note: port numbers are usually changed
its time to determine what protocol they truly use#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Think about the role of Port• Which stream is sending audio / video ? Statistics >Conversation > UDP to look for UDP socket.
• Port 6970 is used for video and 6972 is for audio
because the bytes of UDP6970 are bigger.
• Port 6971,6973 may be used for control streams#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Dissector of the port is correct ?
• UDP 6970 is well known port of RDT ( Real Data
Transport ), but packets are broken. Ex. Packet #28• Well known port is not always correct.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Assume protocol for decoding• UDP stream from port 6972 is not decoded as Audio
protocol, Wireshark says just Data.

• Its time to assume protocol for decoding.
The cheap drive recorder tends to use general
protocols, like RTP ( Real-time Transport Protocol )#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Analyze > Decode As…
• Use “Analyze > Decode As…” to change UDP 6970
and 6972 as RTP ( Real-time transport protocol )• Port 6971 and 6973 is used for RTCP ( Real-time
Transport Control Protocol ) as default#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Decode as Dynamic RTP Type 96/97• This time we succeed to decode udp streams
as RTP (DynamicRTP-Type-96/97)#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Recognized as RTPType-96/97• RTP Type-96 means dynamic assignment RFC3551
by IANA https://www.iana.org/assignments/rtpparameters/rtp-parameters.xhtml• Unfortunately there are few information to determine
the codec.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

SSRC (Synchronization source)• Use “Telephony>RTP streams” to check SSRC

SSRC means 32 bit id of RTP source and the receiverfor playing.
• Select video stream (UDP 6970 SSRC 0x1f46b9fbe)
and click analyze button.
• We can check payload type, number of packets, lost,max delta, max jitter, average jitter and so on.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

RTP Stream Analysis• We can check Skew value,error and so on.
• If the codec is thecommon such as G.711,
we just press “PlayStream” button to playaudio, or “Save” as au fileformat, but in this case,
we don’t know the codec#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Export streams as RTPDump format• Go back to RTP Stream, select video stream(UDP6970) then press “Export…” to export in
RTPDump format.
• Note: Exporting rtpdump may fail in Windows10
with the newest Wireshark3.x (2.x works well)#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

RTP Tools (http://www.cs.columbia.edu/irt/software/rtptools/)• RTPDump is one of RTP Tools for processing RTP
data by Columbia university(http://www.cs.columbia.edu/irt/software/rtptools/)• rtpdump parses and prints RTP packets andgenerating output files suitable for rtpplay andrtpsend.
• rtpplay plays back RTP sessions by rtpdump• rtpsend generates RTP packets by rtpdump or text.
• rtptrans translates between VAT and RTP format#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Send a video RTP Stream• Download RTP Tools windows rtptools-1.18 binary
http://www.cs.columbia.edu/irt/software/rtptools/• rtpplay [-T] [-v] [-f file] [-p profile] [-s sourceport][-b begin] [-e end] destination/port[/ttl]

rtpplay -T -f unknowndriverecorder.rtpdump 127.0.0.1/6970• We can send the RTP video streams from trace file.
• Then we need to determine which codec RTP use#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Check RTP stream sending• Send the RTP Stream using rtpplay

rtpplay -T -f unknowndriverecorder.rtpdump 127.0.0.1/6970• Set capture filter as“udp port 6970”,
start capturing at
loopback interface.
• Look the trace file
to check video RTP
stream is sent.

#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Assume codec• We need to determine codec, so we try mostcommon and BSD license codec, VP8 by Google.
• A RTP video distribution needs the SDP file (Session
Description Protocol ) including codec information• Smartphone app knows the codec, but we don’t.
so let’s start assume codec manually.
Then we create a SDP file including assumed codec.
• If there are rtsp (Real Time Streaming Protocol RFC 2326) packets, we can use this.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Create a sample SDP file (RFC4566)
v=0v: Version
c=IN IP4 127.0.0.1
c: Connection Data
m=video 6970 RTP/AVP 96 m: Media Descriptions
a: Attributes
a=rtpmap:96 VP8/90000• There are example SDP description in RFC4566
https://tools.ietf.org/html/rfc4566• Create text file, input these information as vp8.sdp#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

ffmpeg (ffmpeg.org)• ffmpeg can listen streams and create movie too.
• Read settings from unknowndriverecorder.sdp,
capture RTP stream, then create mkv file.
(mkv is intermediate file of the video)• ffmpeg -v warning -protocol_whitelist file,udp,rtp -f
sdp -i vp8.sdp –copyts –c copy –y../unknowndriverecorder.mkv-v loglevel -protocol_whitelist allowed protocols-f format -i input file -copyts Do not process input timestamps-c copy copy codec -y overwrite output files#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Using ffmpeg to record RTP stream
ffmpeg -v warning -protocol_whitelist
file,udp,rtp -f sdp -i vp8.sdp –copyts –ccopy –y ../unknowndriverecorder.mkv#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Streaming and recording video• We can simulate unknown drive recorder andsmartphone app by sending / receiving packets.
• Start recording and then streaming video
Streaming RTP video from trace file using rtpplay
rtpplay -T -f unknowndriverecorder.rtpdump 127.0.0.1/6970
Recording RTP video from streaming
ffmpeg -v warning -protocol_whitelist file,udp,rtp -f sdp -i
unknowndriverecorder.sdp –copyts –c copy –y../unknowndriverecorder. mkv#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Codec mismatch !!
• There are mismatch of codec if ffmpeg outputs
errors, so try another.

[sdp @ 000002687e5ea380] Could not find codec parameters for stream 0(Video: vp8, yuv420p): unspecified size
Consider increasing the value for the 'analyzeduration' and 'probesize'
options
Output file #0 does not contain any stream#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Change codec as H.264
v=0
c=IN IP4 127.0.0.1
m=video 6970 RTP/AVP 96
a=rtpmap:96 H264/90000• create text file as h264.sdp• H.264 aka MPEG-4 AVC is not open source but
famous codec for many IOT devices.
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Use H264 encoding instead of VP8• Sending rtpplay -T -f unknowndriverecorder.rtpdump 127.0.0.1/6970• Receiving ffmpeg -v warning -protocol_whitelist file,udp,rtp -f sdp -i
h264.sdp -copyts -c copy -y ../unknowndriverecorder.mkv• Output contains some error but we can get mkv data
#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Finally we got the video !!
• Try again to send andreceive the RTP stream,
ffmpeg outputs mkv file(unknowndriverecorder.mkv)• Let’s play mkv fileusing VLC Player#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

Use Wireshark for multimedia• We need to config sdp file with adequate timing andfps and other value to make a better quality video.
• And there are no audio, we need to do the samethings for RTP stream in UDP6972 port

Wireshark is a nice multimedia analyzer too
Wireshark is not only the most used network analyzer
but also a useful audio and video capturing, decoding,
processing tool, USE WIRESHARK#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8

USE WIRESHARK

Thank you for attending !!
Please complete the SharkFest Europe app-based survey

ikeriri network service

http://www.ikeriri.ne.jp#sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8