The info column in the packet display should show an entry something like PT=DynamicRTP-Type-123. To decode to H.264 we need to determine the dynamic RTP type. The packet list should now show as RTP in the protocol column and have an RTP type in the Info column. Click on the Current column and select RTP from the list. Add a new entry using the identified UDP port. Go to the Wireshark menu Analyse -> Decode As. Ip.host=192.168.0.119 & udp.port=4902 Packets filtered by host and UDP port Do this by updating the Wireshark filter to include the UDP port as well as the host, e.g.

In this capture we see lots of traffic sourced from UDP port 4902 – this is most likely the video stream from camera to recording server.įilter the stream, using the UDP Port identified above. There’s a bit of guess work involved here, but the RTP packets are UDP and more than likely the majority of the traffic is one way (Camera -> Recording Server). The next step is to filter out the video packet stream. I p.host=192.168.0.119 Packets filtered by camera host Create a filter on Wireshark to display only the packets from the H264 video source: In this case the camera has an IP address of 192.168.0.119. In the pcap file I am using, I was given the IP address of the camera which makes things easier.

Run the h264extractor Wireshark plugin to extract the H264 stream from the packets.

Export the selected packets to a new cap file.Decode the filtered packets as RTP and configure the H264 dynamic payload type.Filter out the packets that belong to the video stream.The process to get a valid video file requires multiple steps: Use Wireshark to open a network capture, extract an H264 video stream, decode it and reassemble the packets back into a file that can be played.

Wireshark capture packets on localhost