Your boss asks you to begin analyzing the packet capture which he stored in your team’s network file share. The employee does not want to have his computer re-imaged because he is concerned about losing important files, so your boss decided to collect network traffic from the local area network where the employee works to try to identify the root cause of the problem. All you know is that an employee’s machine has been behaving abnormally for a few days but the antivirus software running on the employee’s computer has not detected any malicious files or programs. The company you work for has not made significant investments in security technology, so you don't have a lot of enterprise-grade tools in your arsenal to begin your assignment. You can use cpan or any other way to install them.Imagine it's your first day on the job as a junior security analyst and your assignment is to analyze a large packet capture (PCAP) file that was collected from a monitoring port configured on one of the core switches at a remote site. you'll need perl and some perl libraries.

clone this repo or copy the file to your system.

It's based/inspired by script posted by walto at If the pcap file captured has multiple transport stream, on different IP (group) or UDP Ports, you must use the -p and or -i -p so the extracted TS has only the selected mpeg audio/video.

I had the need troubleshoot multicast traffic, and the closest way to the network card to capture the traffic to evaluate packet loss or damage is using tools like tcpdump, wireshark or other pcap capture option.īut the evaluation of the data stream on a MPEG (video/audio) level using tools like dvbinspector, ffmpeg and others, needs the data correctly formatted as a MPEG TransportStream. It allow you to convert a pcap capture file to a valid mpeg ts video file.

Pcap2mpegts allows you to extract MPEG video from 'pcap' capture (tcpdump/wireshark) of UDP Multicast traffic.

Wireshark pcap analysis