Extract Mpeg TS from Wireshark

Question

I need to extract a MPEG-TS stream from a Wireshark capture. I have managed to do this but when I play it back using VLC the output is crappy, it's just a green window with some jitter on the top rows.

Here is how I did it:

1. Captured using ip.dest filter for the multicast stream.
2. Analyze -> Decode As -> UDP port (field), portnumber (value), MP2T (current)
3. Tools Dump MPEG TS Packets.

It does not play out correctly. Is there any other way of doing this

Answer 1

When I need to dump TS from a pcap file I do following:

1. If TS in plain UDP (column protocol shows MPEG TS for each packet) jump to step 3
2. If TS is packed in RTP, right click on any packet -> Decode as -> Choose RTP under field "Current"
3. Use tool MPEG Dump, Tools -> Dump MPEG TS Packets

I do not use MP2T packets decoding, it usually doesn't work.

If the TS is in plain UDP, it can happen that TS packets are shuffled and 4 bits long TS packet field which serves as a continuity counter is not long enough to correctly order TS packets. This can result in corrupted playback of dumped TS.