python工具-解析wireshark的rtp抓包

最新推荐文章于 2025-09-24 15:28:35 发布

原创

最新推荐文章于 2025-09-24 15:28:35 发布 · 1.5k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#python #wireshark

该博客介绍用Python工具解析Wireshark的RTP抓包。先使用tcpdump或Wireshark抓RTP包，过滤后复制粘贴得到文件，再用Python解析RTP包数据，以便进一步分析。

python工具-解析wireshark的rtp抓包

python工具-解析wireshark的rtp抓包

抓包

将 rtp 包数据，使用 python 解析，然后根据需要，再进一步分析

使用 tcpdump 或 wireshark 抓 rtp 包
过滤 rtp 包，然后 ctrl+A 全选， ctrl+C 复制， ctrl+V 粘贴，得到下边这样内容的文件

2777	2023-10-11 18:13:39.870534	34.203.218.59	10.221.136.184	RTP	230	PT=DynamicRTP-Type-96, SSRC=0x211ADEDA, Seq=6140, Time=2892404731
2780	2023-10-11 18:13:39.870724	34.203.218.59	192.168.68.165	RTP	226	PT=DynamicRTP-Type-96, SSRC=0x211ADEDA, Seq=6140, Time=2892404731
2781	2023-10-11 18:13:39.874006	192.168.68.165	34.203.218.59	RTP	84	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=0, Time=140163930
2789	2023-10-11 18:13:39.876967	192.168.68.165	34.203.218.59	RTP	1266	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=2, Time=140163930[Malformed Packet]
2797	2023-10-11 18:13:39.877428	192.168.68.165	34.203.218.59	RTP	1266	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=4, Time=140163930
2833	2023-10-11 18:13:39.886494	192.168.68.165	34.203.218.59	RTP	259	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=12, Time=140163930, Mark[Malformed Packet]
2837	2023-10-11 18:13:39.886700	192.168.68.165	34.203.218.59	RTP	160	PT=DynamicRTP-Type-96, SSRC=0x1891074E, Seq=0, Time=74781072, Mark
2841	2023-10-11 18:13:39.887322	192.168.68.165	34.203.218.59	RTP	604	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=13, Time=140168430, Mark[Malformed Packet]
2845	2023-10-11 18:13:39.891111	34.203.218.59	10.221.136.184	RTP	230	PT=DynamicRTP-Type-96, SSRC=0x211ADEDA, Seq=6141, Time=2892405691
2849	2023-10-11 18:13:39.892721	192.168.68.165	34.203.218.59	RTP	160	PT=DynamicRTP-Type-96, SSRC=0x1891074E, Seq=1, Time=74781072, Mark
2853	2023-10-11 18:13:39.893076	192.168.68.165	34.203.218.59	RTP	1266	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=14, Time=140172930
2857	2023-10-11 18:13:39.893225	192.168.68.165	34.203.218.59	RTP	765	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=15, Time=140172930, Mark
2861	2023-10-11 18:13:39.900053	192.168.68.165	34.203.218.59	RTP	1197	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=16, Time=140177430, Mark
2865	2023-10-11 18:13:39.912624	34.203.218.59	10.221.136.184	RTP	230	PT=DynamicRTP-Type-96, SSRC=0x211ADEDA, Seq=6142, Time=2892406651
2869	2023-10-11 18:13:39.914207	192.168.68.165	34.203.218.59	RTP	1266	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=17, Time=140181930
2881	2023-10-11 18:13:39.914877	192.168.68.165	34.203.218.59	RTP	364	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=20, Time=140181930, Mark[Malformed Packet]
2887	2023-10-11 18:13:39.933842	34.203.218.59	10.221.136.184	RTP	230	PT=DynamicRTP-Type-96, SSRC=0x211ADEDA, Seq=6143, Time=2892407611
2891	2023-10-11 18:13:39.950241	192.168.68.165	34.203.218.59	RTP	752	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=21, Time=140186430, Mark[Malformed Packet]
2895	2023-10-11 18:13:39.950409	192.168.68.165	34.203.218.59	RTP	1266	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=22, Time=140190930
2899	2023-10-11 18:13:39.950592	192.168.68.165	34.203.218.59	RTP	121	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=23, Time=140190930, Mark[Malformed Packet]
2903	2023-10-11 18:13:39.950805	192.168.68.165	34.203.218.59	RTP	1266	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=24, Time=140195430
2907	2023-10-11 18:13:39.951002	192.168.68.165	34.203.218.59	RTP	643	PT=DynamicRTP-Type-99, SSRC=0x587068D1, Seq=25, Time=140195430, Mark

代码

import sys
import os
import re
from datetime import datetime

# 定义 rtp 结构
class rtp_info:
    def __init__(self) -> None:
        self.seq = -1
        self.ts = 0  # timestamp
        self.st = None  # send time
        self.ssrc = ""
        self.pt = 0
        self.src_ip = None
        self.dst_ip = None
        self.len = 0
        self.protocol=""
        self.no=""

    def __str__(self):
        return f"seq: {
     
     self.seq}" \
        + f", ts: {
     
     self.ts}" \
        + f", st: {
     
     self.st}" \
        + f", ssrc: {
     
     self.ssrc}" \
        + f", pt: {
     
     self.pt}" \
        + f", src_ip: {
     
     self.src_ip}" \
        + f", dst_ip: {
     
     self.dst_ip}" \
        + f", len: {
     
     self.len}" \
        + f", protocol: {
     
     self.protocol}" \
        + f", no: {
     
     self.no}"

    def is_valid(self):
        if self.seq >= 0 and self.ts >= 0 and self.ssrc != "" and self.pt >= 0 and self.src_ip != ""

最低0.47元/天解锁文章