tshark fails to extract RTP data from pcap even if it is available
Using the command:
tshark.exe -r fplay_SVS.pcapng -Y "udp.port==42993 && rtp" -T fields -e rtp.payload > rtp_payload_hex.raw
I use this command to extract the rtp payload. This command worked fine 2 days back . But all of sudden it stopped working . And its extracting a file with zero size.
Something went wrong with my system updates or tshark ? .
Not sure how to get it working.
Note : The same input file I can use it on the wireshark and able to extract the rtp_payload, But I need to automate so i cant use wireshark.
Can you try it using
aaa.pcapfrom the Wiki Sample Captures.tshark -r aaa.pcap -Y "udp.port==30000 && rtp" -T fields -e rtp.payloadDoes adding
-2help?yes it created a 3kb file
I already tried -2 , didnt help
Can you share a pcap that doesn't extract?
Is it possible that
tsharkandWiresharkare using different profiles?Try testing with the individual pieces of your filter to see if the port changed (
-Y "udp.port==42993") orrtpnot being found (-Y "rtp").