从wireshark中获取H264码流详解

1、首先从https://github.com/volvet/h264extractor打包下载

 

2、读README.md 全文如下：

# h264extractor
wireshark plugin to extract h264 stream from rtp packets, support Single NAL Unit Mode(RTP Packetization Mode 0),  FU-A and STAP-A.  In addition, opus stream is supported as well.


# How to use h264extractor
* Copy rtp_h264_extractor.lua to the directory where wireshark was installed
* edit init.lua,  make sure "disable_lua = false" and add "dofile(DATA_DIR.."rtp_h264_extractor.lua")"
* when open pcap file in wireshark,  decode as RTP and configure the H264 dynamic payload types.  
* Menu - Tools - Extract h264 stream from RTP


# How to use opus extractor
* Copy rtp_opus_extractor.lua to the directory where wireshark was installed
* edit init.lua,  make sure "disable_lua = false" and add "dofile(DATA_DIR.."rtp_opus_extractor.lua")"
* when open pcap file in wireshark,  decode as RTP.  
* Menu - Tools - Extract opus stream from RTP


# TODO
* H265 extractor


# Reference
* https://wiki.wireshark.org/Lua
* https://tools.ietf.org/html/rfc6184
* https://tools.ietf.org/html/rfc7587
* https://tools.ietf.org/html/rfc7798

其中H264部分的大意为：

编辑安装目录下的init.lua文件（如WIN10系统可能编辑不了，需要在其它盘下编辑好后，复制过去），需确认

disable_lua = false，在文件最后"dofile(DATA_DIR.."rtp_h264_extractor.lua")"。

把rtp_h264_extractor.lua复制到安装目录下，打开wireshark在工具菜单多了一项：Extract h264 stream from RTP，

如下图所示：

打开wireshark， 在解码为当前值选择RTP。

查看rtp包的payload type（如96），那么在wireshark工具栏选择编辑-首选项->protocols->H264,

把H264 dynamic payload types设成96。

设置完以上，执行工具-Extract h264 stream from RTP，

执行后，会生成dump.264,一般会放在与码流文件同一个路径下。

参考：

http://blog.csdn.net/volvetandanny/article/details/47087641

https://github.com/volvet/h264extractor 

https://wiki.wireshark.org/Lua

http://www.lua.org/