如何从wireshark 抓包中的RTP导出 H.264 PAYLOAD,变成可用暴风直接播放的H264 裸码流文件

最新推荐文章于 2025-05-30 09:40:15 发布

放晴的时候

最新推荐文章于 2025-05-30 09:40:15 发布

阅读量1.6w

点赞数

CC 4.0 BY-SA版权

分类专栏：音视频编解码（H264）

本文链接：https://blog.youkuaiyun.com/u010597161/article/details/16981219

本文介绍如何使用wireshark结合自定义Lua脚本来抓取并导出H.264 RTP包，生成可以直接播放的H264裸码流文件。通过识别并处理Single NALU、STAP-A和FU-A三种封装格式，将RTP数据转换为NALU，并添加SPS和PPS到文件头部。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

在wireshark里面透过 stream analysis，导出来的H264影像没法直接播放，是因为我们需要安装一个插件，Lua脚本如下：

抓取一个包含H.264 Payload RTP包的SIP会话或RTSP会话后，用Wireshark的Play功能只能播放声音，不能播放视频。把RTP payload直接导出成文件后也是不能直接播放的，因为H.264 over RTP封包是符合RFC3984规范的，必须按照该规范把H.264数据取出来后，组成NALU，放到avi/mp4或裸码流文件等容器里后才能播放。

本程序可以识别RFC3984里提到的三种H.264 over RTP封装，分别是Single NALU（一个RTP含一个NALU）、STAP-A（一个RTP包含多个NALU）、FU-A（一个NALU分布到多个RTP包）三种封装格式，且会自动把SPS和PPS放到裸码流文件头部。

-- Dump RTP h.264 payload to raw h.264 file (*.264)
-- According to RFC3984 to dissector H264 payload of RTP to NALU, and write it
-- to from<sourceIp_sourcePort>to<dstIp_dstPort>.264 file. By now, we support single NALU,
-- STAP-A and FU-A format RTP payload for H.264.
-- You can access this feature by menu "Tools->Export H264 to file [HQX's plugins]"
-- Author: Huang Qiangxiong (qiangxiong.huang@gmail.com)
-- change log:
--      2012-03-13
--          Just can play
------------------------------------------------------------------------------------------------
do
    -- for geting h264 data (the field's value is type of ByteArray)
    local f_h264 = Field.new("h264")

    -- menu action. When you click "Tools->Export H264 to file [HQX's plugins]" will run this function
    local function export_h264_to_file()
        -- window for showing information
        local tw = TextWindow.new("Export H264 to File Info Win")
        local pgtw = ProgDlg.new("Export H264 to File Process", "Dumping H264 data to file...")

        -- add message to information window
        function twappend(str)
            tw:append(str)
            tw:append("\n")
        end

        -- running first time for counting and finding sps+pps, second time for real saving
        local first_run = true
        -- variable for storing rtp stream and dumping parameters
        local stream_infos = {}

        -- trigered by all h264 packats
        local my_h264_tap = Listener.new(tap, "h264")

        -- get rtp stream info by src and dst address
        function get_stream_info(pinfo)
            local key = "from_" .. tostring(pinfo.src) .. "_" .. tostring(pinfo.src_port) .. "to" .. tostring(pinfo.dst) .. "_" .. tostring(pinfo.dst_port)
            local stream_info = stream_infos[key]
            if not stream_info then -- if not exists, create one
                stream_info = { }
                stream_info.filename = key.. ".264"
                stream_info.file = io.open(stream_info.filename, "wb")
                stream_info.counter = 0 -- counting h264 total NALUs
                stream_info.counter2 = 0 -- for second time running
                stream_infos[key] = stream_info<