Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] ??????A strange problem about Wireshark

From: "????" <1255768747@xxxxxx>
Date: Wed, 24 Jun 2015 20:01:41 +0800
Dear all,
I am an Wiershark user from China. I put the attached file "h264.lua" into the installation directory of wiershark. And set   "dofile(DATA_DIR.."h264.lua") " at the end of file of "init.lua".  Attached file "aa.pcap" is the capture result of "some rtsp data".
 
The file "aa.pcap" is opened by Wireshark. From the "Tools" manue??we can choose "Export h264 to file", then the h264 raw data file from "aa.pcap" is given by wireshark. the file is attached as "new_wiershark_ver_over_1.10.x.h264" is the raw h.264 data file. This file can't be play by VLC player.
 
However, the same file "aa.pcap" and the same file "h264.lua", using the same method, the raw h264 data file getting from low version wireshark such as version 1.8.3 can be played by VLC directly. The raw h264 data is attached as "wireshark_ver_1.8.3.h264".
 
I confused bye the raw h264 data file of different version of Wiershark. I don't know why cause the different results. I find some HEX number 'ef bf bd ef bf bd " and so on was insert the raw data file. TVB is used in the h264.lua to get raw data , Maybe the TVB 's difference of different wireshark version cause the result.
 
Can you help me?
Thanks! 
 

Attachment: h264.lua
Description: Binary data

Attachment: aa.pcap
Description: Binary data

Attachment: new_wiershark_ver_over_1.10.x.h264
Description: Binary data

Attachment: wireshark_ver_1.8.3.h264
Description: Binary data