> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Pulling Video Out of RTP Streams with Wireshark

> How to turn captured, unencrypted RTP traffic into a playable H.264 video file using Wireshark and a Lua extractor.

IP cameras and streaming apps often protect the part of the session people think about, the login and control channel, while leaving the actual video wide open. If you can see the traffic, you can often rebuild the footage. This post walks through how to take a raw Wireshark capture of RTP traffic and turn it into a video file you can play in VLC.

## Why RTSP is only half the story

RTSP is the control protocol. It runs on port 554 and handles commands like play, pause, and stop, all in plaintext. RTSPS is the same thing wrapped in TLS, so the commands are protected from eavesdropping.

The video itself travels separately over RTP, which carries the compressed audio and video data. RTP is not encrypted by default, and that holds even when the control channel uses RTSPS. SRTP is the encrypted variant that adds encryption, authentication, and integrity checks, but plenty of deployments never turn it on.

> [!NOTE]
>
> This is the key insight behind the whole technique. We aren't attacking the control layer at all. We're going after the unencrypted media stream, which stays exposed regardless of how well the RTSP session is protected.

> **Does RTSPS always leave RTP exposed?**
>
> Not always. If a client negotiates RTSPS with RTP interleaved over the same TLS-protected TCP connection, the media rides inside the tunnel and you won't see it as clean RTP. The exposure shows up when the media is negotiated over separate UDP ports, which is common with IP cameras. Check how the session was set up before assuming the stream is readable.

## What is inside an RTP packet

To rebuild a video you need to know what you're looking at. Each RTP packet has a header with a version, sequence number, timestamp, and an SSRC ID that identifies the stream. It also carries a payload type, which tells you what kind of data follows, and then the payload itself.

For H.264 video, the payload is compressed frames or fragments of frames. A marker bit flags the end of a frame or another important boundary. Large frames get split across several packets, so extraction is really a reassembly job: capture the packets, identify the codec from the payload type, stitch the fragments back into complete frames, and then hand the result to something that can decode it.

> [!NOTE]
>
> H.264 is also called AVC (Advanced Video Coding). It's the codec you'll meet most often in IP cameras and streaming apps, which is why this guide focuses on it.

## Setting up Wireshark

Wireshark can't extract H.264 on its own, so we add a Lua plugin for that. First, find where Wireshark looks for personal plugins.

**1. Find the plugin directory**

Launch Wireshark with administrative privileges and go to **Help** → **About Wireshark** → **Folders**. Copy the path listed next to **Personal Lua Plugins**, open it, and create a `plugins` folder if it doesn't exist yet.

**2. Install the extractor**

Grab `rtp_h264_extractor.lua` from the [h264extractor repository](https://github.com/volvet/h264extractor) and drop it into that folder. Make sure it keeps the `.lua` extension.

**3. Confirm it loaded**

Restart Wireshark completely, then check **Help** → **About Wireshark** → **Plugins**. The script should appear in the list.

**4. Enable the RTP protocols**

Open **Analyze** → **Enabled Protocols**, search for `rtp`, and enable every RTP-related entry. Apply the settings and close the dialog.

![Rtp Img](https://mintcdn.com/0xdev/H6A1K5X7Jdn6VCBN/images/blog/Wireshark%20RTP%20Stream%20to%20Video%20Extraction%20Guide/rtp-img.webp?fit=max\&auto=format\&n=H6A1K5X7Jdn6VCBN\&q=85\&s=27fb8bd01ccda86d67ac1322872fa92a)

> [!TIP]
>
> If the plugin doesn't show up, the usual culprit is the wrong directory or missing read permissions. Restarting Wireshark as administrator fixes it more often than you'd expect.

## Capturing the stream

Pick the interface that sits on the network you're assessing, type `rtp` into the display filter bar, and start the capture. Then either generate traffic from the target or wait for it to appear.

Once packets are flowing, you'll notice something annoying. Wireshark often labels them as plain RTP with an unrecognized payload type, because dynamic or proprietary types don't map to a codec automatically. Fixing that is the next job.

## Telling Wireshark it is H.264

Select any RTP packet and expand the **Real-Time Transport Protocol** section in the details pane. Find the **Payload type** field and note the number. In my capture it showed as "Unassigned (35)".

![Payload Nr](https://mintcdn.com/0xdev/H6A1K5X7Jdn6VCBN/images/blog/Wireshark%20RTP%20Stream%20to%20Video%20Extraction%20Guide/payload-nr.webp?fit=max\&auto=format\&n=H6A1K5X7Jdn6VCBN\&q=85\&s=9e5fcee1fc95f97060077daf5ec8237e)

That number varies between cameras and streams, so don't assume 96 or 35. Whatever you see is what you need to map.

**1. Open the H.264 preferences**

Go to **Edit** → **Preferences**, expand **Protocols**, scroll down, and select **H.264**.

**2. Enter your payload type**

Put the number you noted into the **Dynamic payload types** field. If it was 35, enter `35`, then click **OK**.

**3. Check the result**

Go back to the capture. The RTP packets should now show **H.264** in the Protocol column.

![H 264](https://mintcdn.com/0xdev/H6A1K5X7Jdn6VCBN/images/blog/Wireshark%20RTP%20Stream%20to%20Video%20Extraction%20Guide/h-264.webp?fit=max\&auto=format\&n=H6A1K5X7Jdn6VCBN\&q=85\&s=5554b135b16f560f7ab955787ad9261d)

## Extracting and playing the video

With the mapping in place, go to **Tools** → **Extract H264 stream from RTP**. A dialog appears, and when it finishes it shows the output path. Look in that directory for a file with the `.h264` extension.

![Extractor](https://mintcdn.com/0xdev/H6A1K5X7Jdn6VCBN/images/blog/Wireshark%20RTP%20Stream%20to%20Video%20Extraction%20Guide/extractor.webp?fit=max\&auto=format\&n=H6A1K5X7Jdn6VCBN\&q=85\&s=b26b6dfaf7b62ef4288b78aa94ae9882)

That file is raw H.264, not a container, so open it with VLC or another player that handles raw streams, such as FFplay or Media Player Classic. If you want something more portable, FFmpeg can wrap it without re-encoding:

```bash theme={null}
ffmpeg -i input.h264 -c copy output.mp4
```

Here is what the recovered footage looks like in VLC:

![Video Output](https://mintcdn.com/0xdev/H6A1K5X7Jdn6VCBN/images/blog/Wireshark%20RTP%20Stream%20to%20Video%20Extraction%20Guide/video-output.webp?fit=max\&auto=format\&n=H6A1K5X7Jdn6VCBN\&q=85\&s=38045722732b89fb757744fcba810d27)

> [!WARNING]
>
> Only capture traffic on networks you are explicitly authorized to test. Recovered video can contain sensitive footage of people and places, so treat the output files as evidence: store them securely and delete them when the engagement ends.

## When it doesn't work

> **No RTP packets visible**
>
> Check that you selected the right interface and that you're on the correct network segment. Also confirm the RTSP stream is actually active, since an idle camera produces no media traffic.

> **Payload type shows as unknown**
>
> Set the payload type manually in the H.264 preferences as described above. If the mapping doesn't help, the stream may use a different codec such as H.265 or MJPEG, and this plugin won't handle it.

> **Extracted video won't play**
>
> Try a different player first, then try the FFmpeg conversion above. It's also worth checking whether the extraction finished without errors, because a truncated capture produces a broken file.

> **Plugin not loading**
>
> Verify the Lua script is in the Personal Lua Plugins directory and that Wireshark can read it. Restarting Wireshark as administrator is the quickest fix.

## The takeaway

Encrypting the control channel doesn't protect the video. Whenever RTP is negotiated separately and left unencrypted, anyone who can see the packets can reassemble the footage with a Lua script and a few menu clicks. If you're assessing a streaming deployment, check the media layer specifically, and if you're defending one, turn on SRTP.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.