Tracking i b p frames in a PCAP file

retag add tags

I am working through a PCAP file that consists of a single channel of MPEG TS packets carried over UDP in Wireshark and I had a few questions

What's the difference between the more numerous TS packets and the PES packets? The TS packets are far more numerous
Is there a way to analyze the payloads of the TS packets and extract the i b p frames from the data along with timestamps so that I could perhaps see their throughput?

Hi,

Packetized Elementary Stream (PES) is a data format for carrying elementary streams (audio, video, etc.) where these streams are packetized. These are what you are referring to as TS packets.

Simply put, you only get one PES header per stream once in while and lots of actual data packets for the stream itself so that is why you see a difference in quantity.

PES has a header for each stream and each piece of that stream as a header as well. You can filter through that using display filters for PES headers.

I suggest you read up on PES and MPEG TS to familiarize yourself with the format of the different headers.

Old forum post suggests using mpeg-pes.frame_type for filtering frame type.

Using mpeg-pes.frame_type you can filter by using an integer representing the frame type:

static const value_string mpeg_pes_T_frame_type_vals[] = {
  {   1, "i-frame" },
  {   2, "p-frame" },
  {   3, "b-frame" },
  {   4, "d-frame" },
  { 0, NULL }
};

Not all header fields may be present so YMMV.

Cheers,

JFD

191

Spooky

answered 2020-07-08 03:06:28 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Tracking i b p frames in a PCAP file edit

Comments

1 Answer

Comments