Revision history  [back]

Hello everybody, I am using tshark to filter data from rtp stream from pcap file. First, I list all rtp stream by command

tshark -r rtp.pcap -q -z rtp,streams

After that, I filter data from each stream by command

tshark -r -Y "rtp.ssrc==xxx" -T fields -e rtp.payload > data.raw

with xxx is ssrc of each stream. But the time that I spend too long to filter all stream. I think because each time I run tshark to filter a stream, tshark must read all pcap file, so if I have n rtp streams, Tshark will read file pcap n times. Can I speed up the filtering process? Thank you so much.

Regard,

Kien