Convert a Sniffer Trace to MPEG (Video) File Viewable With VLC

Introduction

This document describes how to convert a sniffer trace containing MPEG traffic into a video that you can watch with VLC.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Wireshark
• MPEG
• VLC

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The packet capture in this specific case has been taken between a cBR8 and RPHY, and converted into a video stream viewable with VLC.

The goal is to not only enjoy watching videos for professional reasons on the workplace but also witness quality issues in video stream such as pixellization (macroblocking or tiling issues).

Problem: Convert a Sniffer Trace to MPEG and View it with VLC

Wireshark might not automatically recognize the traffic as MPEG traffic, for example, if it was taken on a link between a Cable Modem Termination System (CMTS) and a Remote PHY Device (RPD), it might decode the traffic as UEPI instead:

Solution

Convert the Packets in MPEG

Step 1. Select a UEPI packet, right click on PSP header in the packet detail view, and click on Decode As.

Step 2. Under Current menu, choose UDP in the protocol list and click OK.

You now see UDP packets (Wireshark might decode it as any other UDP protocol, depending on the port number, if you still don't see MPEG packets, continue to the next step).

Step 3. Select a UDP packet, right click on the protocol header, and select Decode As.

Step 4. Under Current menu choose MP2T in the protocol list and click OK

After that, you see MPEG packets, as shown in the image:

In order to decode the packets correctly as MPEG, you can watch this video:

Convert the MPEG Trace into a Viewable Video File

Step 1. Install the LUA MPEG DUMP Wireshark plugin, available here: mpeg_dump.lua.

For MAC OS users, you can download the plugin named mpeg_packets_dump.lua at the above-linked page, and move it in the path: /Applications/Wireshark.app/Contents/Resources/share/wireshark.

In the same folder, append the line <dofile("mpeg_packets_dump.lua")> at the end of the file named init.lua.

Step 2. You must now see a new item in Wireshark, navigate to Tools > Dump MPEG TS Packets, as shown in the image:

Select it, and enter a file name, eventually a filter if you want to extract some part of the stream only (for example a single PID, if the stream contains multiple).

This creates a .ts file, which is viewable with VLC as a video stream: 

This image purposely displays video tiling, to show how this process is indeed useful to find video stream problems.

How to Open Any MPEG Video With Wireshark?

As a side topic, Wireshark supports any MPEG video file and correctly shows the MPEG packets (of course, without any IP headers, since there isn't any in your local file):

This is extremely useful if you want to ensure the source video file is correct. If the source video file contains CC errors, no magic here, there is a possibility of CC errors all the way through. 

Also, it can be useful in case you can only receive the video using a DVB-C USB dongle, which captures MPEG packets and allows to store the video stream as a file. You can then reopen-it with wireshark to ensure it is correct.