Extract audio file from RTP streams in pcap format
Extract media files from RTP streams in pcap format
This program is intended to support usual audio/video codecs used on IMS networks (VoLTE/VoWiFi).
Therefore, some codecs might be limited to usual scenarios on these networks.
Payload Type | Support |
---|---|
1-23 NAL Unit | Yes |
24 STAP-A | No - planned |
25 STAP-B | No |
26 MTAP16 | No |
27 MTAP24 | Yes |
28 FU-A | Yes |
29 FU-B | No |
In order to support dumping VoWiFi media some support for ESP (Encapsulating Security Payload) decryption is present.
Encryption Algorithm | Support |
---|---|
3DES CBC | Yes |
DES CBC | No - Planned |
AES CBC | No - Planned |
Keys are read from file 'esp-keys.txt' on the current directory by default. One key per file, for example:
[SPI] [Encryption Algorithm] [Key]
0x00d40016 des3_cbc 0x091199869ec18afd8e38f77eb1252685924937d3921a178e
0xcb97da43 des3_cbc 0xaaa316cd3fa41daa9afe6e8f42a9ae0ce2bd5128cef5a60f
Global flag -k
can be used to indicate another key file path. Check -help
.
Its possible to replay a RTP stream, specifying the destination host and port. The stream consumer can be a actual mobile handset or any application that can interpret RTP streams (e.g VLC).
The stream is replayed as is, taking into account the original timestamps in the pcap file and mantaining the original RTP payload type. It's up to the receiver to interpret the appropriate stream codec.
For example, VLC accepts a SDP input file:
v=0
c=IN IP4 127.0.0.1
m=audio 1234 RTP/AVP 99
a=rtpmap:99 AMR/8000
rtpdump play --host localhost --port 1234 [pcap containing amr-nb payload type 99]
Checkout gopacket.
Linux should be straightforward.
For Windows, make sure mingw(32/64) toolchain is on PATH for gopacket WinPcap dependency. Install WinPcap on standard location C:\WpdPack
Are always appreciated.