console convert pcap to wav: not easily possible; use the WireShark GUI to do
Posted by jpluimers on 2021/12/01
Wanting a simple way on the console to convert a .pcap file to a .wav file, I searched for [Wayback] console convert pcap to wav – Google Search.
The reason is that [Wayback] fritzcap (written in Python) sometimes crashes while doing the conversion of a phone recording, so then only the .pcap file is available. I still want to figure this out, but given my health situation, I might not be able to in time.
If anyone with Python experience can help, I have failing capture files lying around, and the
fritzcapcommand-line does support decoding [Wayback/Archive.is]:# feature/re-add_documentation(+0/-0)* ± python fritzcap.py --help usage: fritzcap.py [-h] [-v] [-c] [-d [file [file ...]]] [-m] [-p password] [-u username] [-s] [--config_file path_to_file] [--logging_config path_to_file] [--box_name host_or_IP] [--call_service_port port] [--login_not_required] [--protocol protocol] [--cap_folder path_pattern] [--cap_file file_pattern] [--cap_interface cap_interface] [--after_capture_time time_in_seconds] [--decode_workers_count int] ... main arguments: ... -d [file [file ...]], --decode_files [file [file ...]] the list of captured files to decode. All the new captures files will be decode automatically if the --capture switch is set. Read the files from the standard input if the list of files is empty and there is no capture work.
Back to other tooling for decoding VoIPcap/pcap files
Too bad there are no easy solutions. You can use the WireShark GUI to do this, which is OK for infrequent conversions.
Here were some of the results leading me to that conclusion:
- [Wayback] Convert RTP packets to WAV or AU using ffmpeg – Stack Overflow
If your intention is to hear the voice present in .pcap file you can follow the below steps.
Install Wireshark:
- File -> open filename.pcap
- Analyze -> Decode Asselect RTP from the list then click on apply
- Telephony -> RTP -> Show All Streams -> Analyze
- Then click on Player -> Decode
- Enable the check box appearing for each file and play
- Now you can here the streams.
Note: Make sure that you have latest version of Wireshark installed.
- [Wayback] voip – Converting PCAP to WAV – Network Engineering Stack Exchange
Here you go!
1. EnterRTPin the display filter in Wireshark when the capture is open.
2. Now select an RTP packet in any stream and click on the menu optionTelephony.
3. Go toRTP>Stream Analysisand click onSave Payloadbutton.
4. Change the format to.auand choose a name (lets saytest.au) and location for your file.
5. Play it using your favorite audio player.
OR
5. Run the following command to convert the.aufile to.wavif you like.wavfiles better:sox test.au -V -t wav -b 16 -c 2 test.wavHope that helps!
- [Wayback] RTP_statistics · Wiki · Wireshark Foundation / wireshark · GitLab (moved from [Wayback] RTP_statistics – The Wireshark Wiki)
You can save the content of an RTP audio stream to an Au-file directly from Wireshark. This is done from the “RTP Stream Analysis” dialog by pressing the “Save” button and select one of ‘… Audio’ options, then select ‘Sun Audio’ file format.
- [Wayback] Converting RTP in pcap to Audio Wav files – SDET
ssrc=$(sudo tshark -n -r capture.pcap -R rtp -T fields -e rtp.ssrc -Eseparator=, | sort -u) echo $ssrc sudo tshark -n -r capture.pcap -R rtp -R “rtp.ssrc == $ssrc” -T fields -e rtp.payload | tee payloads for payload in `cat payloads`; do IFS=:; for byte in $payload; do printf “\\x$byte” >> sound.raw; done; done echo ‘sox has converted pcap to wav file’ sudo sox -t raw -r 8000 -c 1 -U sound.raw capture3d.wav - [Wayback] Wireshark Q&A: pcap to au-file in command line
- [Wayback] Wireshark Q&A: Can TShark extract voice data from an RTP stream?
afaik that’s not possible with tshark (please correct, if I’m wrong). However, there are open source tools, that can do it.
http://sourceforge.net/projects/pcapsipdump/
http://frox25.no-ip.org/~mtve/wiki/RtpExtract.htmland for “big data”:
http://www.sipcapture.org/
http://sourceforge.net/projects/our/Regards
Kurt
- [Wayback] Wireshark Q&A: Can TShark extract voice data from an RTP stream?
--jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment