get h.265 video file from pcap rtp capture

1
votes

I am trying to extract video file from h.265 encoded & unencrypted rtsp/rtp pcap capture. I tried extracting rtp stream raw data and tried play it using vlc but not working. Is there any way can i get h.265 video file from pcap capture.

1
video-capturertpcodecpcaph.265
vlc should work. Are you sure the stream isn't encrypted? – Kozyr
I am sure that its not encrypted. I tried with sample h.265 capture from wireshark example captures from following link wiki.wireshark.org/… – gss2408
I wrote simple .pcap-parser with h265 depacketizaion and got h.265 video from pcap. Now i'm wondering, is it correct? – Kozyr
possibility headers are missing. – sagar

1 Answers

1
votes

Actually, it is a tricky thing. A similar concept was implemented by http://ucsniff.sourceforge.net/videosnarf.html for h264, but they don't support h265 so I adopted the method. The main idea is that you have to add some parts that are missing.

As it is mentioned in https://tools.ietf.org/html/rfc7798 the header is like this:

+---------------+---------------+
|0|1|2|3|4|5|6|7|0|1|2|3|4|5|6|7|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|F|   Type    |  LayerId  | TID |
+-------------+-----------------+

You have to add the removed header for every elementary stream packet, which is 4 Bytes (00 00 00 01).

But we all know the h265 packets are too long and most of them are fragmented, and as I understand the players like VLC don't support fragmentation. So you have to reassemble them. This process is only for fragmented packets types (like 49). You have an additional header which is like this:

+---------------+
|0|1|2|3|4|5|6|7|
+-+-+-+-+-+-+-+-+
|S|E|  FuType   |
+---------------+

the bits S and E tells you how to reassemble the packets. The first packet in the sequence has S,E = 1,0 and others continue with S,E = 0,0 (maybe multiple packets) and the final one has S,E = 0,1. All the payload bytes are concatenated then a new header is created by replacing the type in the main header with the FuType mentioned here like this (and don't forget the 4Byte header):

+---------------+---------------+--------------
|0|1|2|3|4|5|6|7|0|1|2|3|4|5|6|7|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--------------
|F|  FuType   |  LayerId  | TID | all the concatenated payloads
+-------------+-----------------+---------------

Just remember you have to keep both the fragmented and nonfragmented payload since most of the unfragmented packets have crucial information like picture size which cannot be omitted. The elementary stream can be played by SMplayer or you can use VLC. For VLC you have to set the demuxer to h265.