Wireshark · Ethereal-users: Re: [Ethereal-users] Play audio snifed with ethereal

[James Cloos <cloos@xxxxxxxxxxx>]

>>>>> "Javier" == Javier Ramirez <jvr_78@xxxxxxxxxxxx> writes:

Javier> Hi, I need a aplication, that play audio snifed with ethereal

There is a perl module that can decode pcap files; it makes it easy
to grab the payload of rtp packets.

The below bit of perl uses Net::Pcap to do the heavy lifting, drops
the first 54 octets of each packet (802 frame headers, ipv4 headers,
udp headers and rtp headers) and writes the rest to a target file.

Use (t)ethereal first to isolate just the (unidirectional) rtp
packets into a pcap file before passing it to this sample script.

Get Net::Pcap from cpan.org if it is not included in your dist.
(It is in freebsd's ports, gentoo's portage, probably others.)

NB:  Just a quick and simple example; needs a lot of work
     to be a generally useful application.....

-JimC

#!/usr/bin/perl

use Net::Pcap;

die "Usage: $0 infile outfile" unless scalar(@ARGV) > 1;

my $err;

open(my $out, '>', $ARGV[1]) or die "cannot open in file: $!";

my $pcap = Net::Pcap::open_offline($ARGV[0], \$err);
Net::Pcap::dispatch($pcap, 0, \&process_pkt, $out);
Net::Pcap::close($pcap);
close($out);

sub process_pkt {
# skip first 54 octets and write rest to $out
    my($out, $hdr, $pkt) = @_;
    
    my $payload = substr($pkt, 54);

    print $out $payload;
}