How would I go about converting a RTP stream from a pcap file to wav format with a command-line tool such as sox?


2 Answers 2


Here you go!
1. Enter RTP in the display filter in Wireshark when the capture is open.
2. Now select an RTP packet in any stream and click on the menu option Telephony.
3. Go to RTP>Stream Analysis and click on Save Payload button.
4. Change the format to .au and choose a name (lets say test.au) and location for your file.
5. Play it using your favorite audio player.
5. Run the following command to convert the .au file to .wav if you like .wav files better: sox test.au -V -t wav -b 16 -c 2 test.wav

Hope that helps!

  • 2
    Is it possible to do this completly via command line?
    – eKKiM
    Jul 12, 2019 at 9:13

This Docker container has a command line tool called mediaMin that handles pcaps with multiple concurrent RTP streams, different codecs, and streams that create child streams per RFC8108. Cmd line examples use pcaps included in the container. Output wav files are generated for each stream and optionally for "merged audio" of all streams.

.sdp files can be used to override codec auto-detection and/or select only specific streams

Disclaimer: I work for the company that created this tool

Not the answer you're looking for? Browse other questions tagged or ask your own question.