Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Is it possible to identify a protocol in a pcap file? I have a file which is a capture of data going between my phone and an IP camera, and I'd like to identify the protocol. I am using the app "MEye" to view the camera, which provides no hints of the protocol used.
I have tried googling the headers in some of the packets, but to no avail.
The pcap file can be found here.
Is it possible to identify the protocol at all?
Is it possible to identify a protocol in a pcap file?
Yes, but this appears to be a proprietary protocol over TCP/IP.
The first four bytes of every message is a 32-bit big-endian value that specifies the length of the following bytes in the message.
The messages aren't encrypted, so you might be able to do some data carving. But if you really want to know what's going on, your best bet is to reverse engineer your "MEye" app as opposed to relying solely on the packet capture to understand the protocol.
Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate Format" and "Quarter Common Intermediate Format" respectively. They are defined within the "H.261 Video codec for audiovisual services at p x 64 kbit/s" standard, so you may find sufficient detail within those documents (which are available for free) to be able to start making some intelligent guesses as to how to decode this particular protocol.
With that said, Wireshark, as least as of September 2014, does not support H.261 decoding. Perhaps you could add it.
