[Freeswitch-users] Extract audio from PCAP

[Michael Collins]

On Wed, Mar 6, 2013 at 12:11 PM, Avi Marcus <avi at avimarcus.net> wrote:

> Wow, that's a complicated procedure.
> Identify the IP, then extract the rtp, then convert that to raw audio,
> then you need to know exactly what type of raw audio to open it.
> By the way, I tried processing a 230mb PCAP.. that last batch with the for
>  loops sucked an entire core and I stopped it after like 15 mins. Payloads
> was 238mb and the sounds.raw only got up to 53mb before I stopped it.. I
> don't know how far it would have gotten.
>
> Michael, is there something faster? :)
> -Avi
>
> Faster processor? :)

You need to assemble all of those packets, no way around it. I am working
on a script to handle that but it's nowhere near ready for public
consumption. Believe me, if you only need to get the RTP from a pcap then
that procedure is not too difficult. (You could probably have done it in
less time than it took to write that email. ;)

I've wrapped that process into a script but I'm trying to handle all the
other stuff like getting each stream extracted and then launching sox or
the the new-and-improved fs_encode to convert from raw audio to wav file.
I'll let everyone know when it is done and put it up on the wiki.

-MC


>
> On Wed, Mar 6, 2013 at 9:45 PM, Michael Collins <msc at freeswitch.org>wrote:
>
>> I like that cool Perl script. I'll have to try that some time. In the
>> meantime you can use tshark to extract the rtp and then use sox to turn
>> them into wav files. I'm working on a script to do that automatically, but
>> in the meantime this post should help:
>>
>>
>> http://gteissier.wordpress.com/2010/03/02/tshark-the-swiss-army-knife-of-packet-analysis/
>>
>> -MC
>>
>>
>> On Sun, Mar 3, 2013 at 4:40 PM, shouldbe q931 <shouldbeq931 at gmail.com>wrote:
>>
>>> On Sun, Mar 3, 2013 at 11:40 PM, Avi Marcus <avi at avimarcus.net> wrote:
>>> > I've have some really large PCAPs sometimes and wireshark just dies
>>> trying
>>> > to decode the audio in them.
>>> >
>>> > All the links for audio extraction on voipinfo seem really old.
>>> >
>>> > Is there something else to extract the audio from pcaps? Or some
>>> command to
>>> > to pass tshark to just save all audio as a .wav file?
>>> >
>>> > What does voipmonitor use?
>>> > I think I asked this before...
>>> >
>>> > Thanks,
>>> > -Avi Marcus
>>>
>>> How big are the pcap files ?
>>>
>>> you could use editcap to split them up into more manageable chunks,
>>> and then use wireshark...
>>> http://www.wireshark.org/docs/man-pages/editcap.html
>>>
>>> I've not either but, youmight look at
>>>
>>> http://frox25.no-ip.org/~mtve/wiki/RtpExtract.html
>>>
>>> and
>>>
>>> http://www.netresec.com/?page=NetworkMiner
>>>
>>> Cheers
>>>
>>> Arne
>>>
>>> _________________________________________________________________________
>>> Professional FreeSWITCH Consulting Services:
>>> consulting at freeswitch.org
>>> http://www.freeswitchsolutions.com
>>>
>>> 
>>> 
>>>
>>> Official FreeSWITCH Sites
>>> http://www.freeswitch.org
>>> http://wiki.freeswitch.org
>>> http://www.cluecon.com
>>>
>>> FreeSWITCH-users mailing list
>>> FreeSWITCH-users at lists.freeswitch.org
>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>> http://www.freeswitch.org
>>>
>>
>>
>>
>> --
>> Michael S Collins
>> Twitter: @mercutioviz
>> http://www.FreeSWITCH.org
>> http://www.ClueCon.com
>> http://www.OSTAG.org
>>
>>
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org
>> http://www.freeswitchsolutions.com
>>
>> 
>> 
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>>
>>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>


-- 
Michael S Collins
Twitter: @mercutioviz
http://www.FreeSWITCH.org
http://www.ClueCon.com
http://www.OSTAG.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130306/1c580661/attachment-0001.html