MPEG2TS can be also detected in a heuristic way if transported over UDP.
These are some rules that can be applied:
1) UDP payload length must be a multiple of 188 (usually a UDP packet contains an integer number of TS packets, where each TS packet is 188 bytes).
2) The first octet of each TS packet inside the UDP payload must be equal to 0x47 (sync byte)
3) At least 2 or 3 consecutives UDP packets satisfying rules 1) and 2) onthe same IP address and UDP port.
On Nov 30, 2007 2:07 AM, Jake Peavy <
djstunks@xxxxxxxxx> wrote:
Thanks Jaap,
So why isn't the MPEG dissector in the list when I choose "Decode As.." for a UDP encapsulated stream? That was the OP's question I believe.
-jp
On Nov 29, 2007 3:11 PM, Jaap Keuter <
jaap.keuter@xxxxxxxxx> wrote:
Hi,
No, the intelligence isn't put into the RTP dissector, it's the other
way around. The MPEG2TS dissectors registers itself with the RTP
dissector, for payload type 33 (PT_MP2T, RFC 2250). If the RTP dissector
gets such a payload it's passed to the MPEG2TS dissector.
What could be done is adding a preference to the MPEG2TS dissector to
set a UDP port number to register on, so that ETH/IP/UDP/MPEG2TS is
possible.
Thanx,
Jaap
Jake Peavy wrote:
> Yes, I also noticed this. With an RTP encapsulated video stream, the
> PIDs are decoded. With a UDP encapsulated video stream, no decocde is
> possible.
>
> Does this mean this intelligence was built into the RTP module? That
> seems to go against the whole point of encapsulation. It would be far
> better to have a separate MPEGTS dissector - to apply against any type
> of stream.
>
> -jp
>
>
> On Nov 29, 2007 11:06 AM, maurizio simoni <
mau2000.sim@xxxxxxxxx> <mailto:
mau2000.sim@xxxxxxxxx>> wrote:
>
> HI,
>
> MPEG2 Transport Streams packets are not decoded if they are
> transported directly over UDP (i.e. if RTP is not present).
> Moreover MPEG2TS is not present in the list of protocols in "Decode
> As" list, so there is no way to decode MPEG2TS over UDP neither
> automatically ( i.e. by automatically detect that the UDP payload is
> MPEG2TS) nor manually (that means to add MPEG2TS to "Decode As" list)
>
> Mau.
> _______________________________________________
> Wireshark-users mailing list
--
-jp
When Chuck Norris was in middle school, his English teacher assigned an essay: "What is Courage?" Chuck Norris received an "A+" for writing only the words "Chuck Norris" and promptly turning in the paper.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
