Small Tool, export original hexadecimal data from Wireshark, and then export rtppayload data

You can export the packages captured by Wireshark: file-> export-> File

You can select the export format under packet format, but if the required data is a combination of multiple packages, it will be troublesome, because the exported data will add the header information of the link layer, IP layer, and Transport Layer in any case, it is basically possible to manually delete the data.

For example, I captured a lot of RTP packets, but I only want to retrieve the RTP payload to analyze whether the data is correct. I can do this:

First, export the data in packet byte format. I save the data in raw. dat. The data format is as follows (a package in Wireshark ):

Then extract the hexadecimal data and run the following code:

# Include "stdlib. H "# include" stdio. H "typedef Enum state // state machine implementation {ignore, waitcr, waitlf, ready, read_l, read_h} state; int atoi (unsigned char * pdata) {unsigned char TMP [2]; int ret; TMP [0] = * pdata; TMP [1] = * (pdata + 1); For (INT I = 0; I <2; I ++) {If (TMP [I] <= 0x39 & TMP [I]> = 0x30) {TMP [I] & = 0x0f ;} else if (TMP [I] <= 0x66 & TMP [I]> = 0x61) {TMP [I] = 9 + TMP [I] & 0x0f ;} else {printf ("Err \ n"); Return-1 ;}} ret = TMP [0] * 16 + TMP [1]; return ret;} int main () {file * fi, * fo; FI = fopen ("raw. dat "," rb "); fo = fopen (" RTP. dat "," WB "); State stat = ignore; unsigned char TMP; int hex; unsigned char ch [2] = {0}; int COUNT = 0, line = 0; int blankcount = 0; bool bfalse = false; unsigned long packetcount = 0; while (! Feof (FI )&&! Bfalse) {TMP = fgetc (FI); Switch (STAT) {Case ignore: If (TMP = 0x20) {stat = ready;} break; Case waitcr: if (TMP = 0x0d) {stat = waitlf;} break; Case waitlf: If (TMP = 0x0a) {stat = ignore;} break; case ready: If (TMP! = 0x20) {ch [0] = TMP; stat = read_l; blankcount = 0;} else {If (++ blankcount> = 2) {packetcount ++; blankcount = 0; Count = 0; stat = waitcr ;}} break; Case read_l: ch [1] = TMP; stat = read_h; break; Case read_h: hex = atoi (CH); If (hex <0) {bfalse = true; break;} fputc (Hex, FO); If (++ COUNT = 16) {COUNT = 0; line ++; stat = waitcr;} else {stat = ready;} break ;}} fclose (FI); fclose (FO); Return 0 ;}

Because I captured RTP data, I wrote another small tool to extract RTP data from the raw data extracted above:

# Include "stdlib. H "# include" stdio. H "# include <assert. h> int main () {file * fi, * fo; FI = fopen ("raw. dat "," rb "); fo = fopen (" RTP. dat "," WB "); If (! FI |! Fo) {return-1;} int ret = 0; unsigned long totallen = 0, packetlen = 0; unsigned Long Count = 0; unsigned char * pbuf = new unsigned char [10*1024*1024]; unsigned char * PPOs = pbuf; int paddinglen = 0; bool bhaspadding = false; do {ret = fread (PPOs, 1, 1024*1024, FI); totallen + = ret; PPOs + = ret;} while (Ret> 0); PPOs = pbuf; do {While (totallen> 0) {If (* PPOs! = 0x50 | * (PPOs + 1 )! = 0xe5) {printf ("has decode % d \ n", count); break;} packetlen = (* (PPOs + 38) <8) + * (PPOs + 39); packetlen-= (8 + 12); If (packetlen> 1460) {break;} PPOs + = (14 + 20 + 8 + 12 ); if (packetlen! = Fwrite (PPOs, 1, packetlen, FO) {break;} count ++; PPOs + = packetlen; // If the payload of RTP is 4, the length of the Ethernet package must be 4 + 12 + 8 + 20 + 14 = 58 less than 60 // Therefore, there will be 2 bytes to be discarded if (packetlen = 4) {PPOs + = 2 ;}}while (0); Delete [] pbuf; fclose (FI); fclose (FO); Return 0 ;}

Other transport layer data can be extracted similarly without removing the RTP Header Length (12 ).