Is it possible to identify a protocol in a pcap file? I have a file which is a capture of data going between my phone and an IP camera, and I'd like to identify the protocol. I am using the app "MEye" to view the camera, which provides no hints of the protocol used.

I have tried googling the headers in some of the packets, but to no avail.

The pcap file can be found here.

Is it possible to identify the protocol at all?

  • I'm also interested in "meye" protocol. Have you made any progress?
    – TruongSinh
    May 5, 2017 at 6:48

2 Answers 2


Is it possible to identify a protocol in a pcap file?

Yes, but this appears to be a proprietary protocol over TCP/IP.

The first four bytes of every message is a 32-bit big-endian value that specifies the length of the following bytes in the message.

The messages aren't encrypted, so you might be able to do some data carving. But if you really want to know what's going on, your best bet is to reverse engineer your "MEye" app as opposed to relying solely on the packet capture to understand the protocol.


Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate Format" and "Quarter Common Intermediate Format" respectively. They are defined within the "H.261 Video codec for audiovisual services at p x 64 kbit/s" standard, so you may find sufficient detail within those documents (which are available for free) to be able to start making some intelligent guesses as to how to decode this particular protocol.

With that said, Wireshark, as least as of September 2014, does not support H.261 decoding. Perhaps you could add it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.