Hello everybody, I am using tshark to filter data from rtp stream from pcap file. First, I list all rtp stream by command
tshark -r rtp.pcap -q -z rtp,streams
After that, I filter data from each stream by command
tshark -r <pcap file=""> -Y "rtp.ssrc==xxx" -T fields -e rtp.payload > data.raw
with xxx is ssrc of each stream. But the time that I spend too long to filter all stream. I think because each time I run tshark to filter a stream, tshark must read all pcap file, so if I have n rtp streams, Tshark will read file pcap n times. Can I speed up the filtering process? Thank you so much.
Regard,
Kien
