Ask Your Question

Tracking i b p frames in a PCAP file

asked 2020-07-06 18:24:55 +0000

Null_404 gravatar image

I am working through a PCAP file that consists of a single channel of MPEG TS packets carried over UDP in Wireshark and I had a few questions

  1. What's the difference between the more numerous TS packets and the PES packets? The TS packets are far more numerous
  2. Is there a way to analyze the payloads of the TS packets and extract the i b p frames from the data along with timestamps so that I could perhaps see their throughput?
edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-07-08 03:06:28 +0000


Packetized Elementary Stream (PES) is a data format for carrying elementary streams (audio, video, etc.) where these streams are packetized. These are what you are referring to as TS packets.

Simply put, you only get one PES header per stream once in while and lots of actual data packets for the stream itself so that is why you see a difference in quantity.

PES has a header for each stream and each piece of that stream as a header as well. You can filter through that using display filters for PES headers.

I suggest you read up on PES and MPEG TS to familiarize yourself with the format of the different headers.

Old forum post suggests using mpeg-pes.frame_type for filtering frame type.

Using mpeg-pes.frame_type you can filter by using an integer representing the frame type:

static const value_string mpeg_pes_T_frame_type_vals[] = {
  {   1, "i-frame" },
  {   2, "p-frame" },
  {   3, "b-frame" },
  {   4, "d-frame" },
  { 0, NULL }

Not all header fields may be present so YMMV.



edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-07-06 18:24:55 +0000

Seen: 488 times

Last updated: Jul 08 '20