Cisco Support Community

How to Find I-frame Using Wireshark for H.323 Video Communication



    We often perform a packet capture analysis for troubleshooting of H.323 video conferences.

    I will show you how to find I-frame from the H.264 RTP packets using Wireshark here.


    I am using the duo video (content channel, sharing materials) stream between MCU and EndPoint as an example here.

    The captured packet was acquired by the terminal used to watch the duo video. It includes the communication between VCS and MCU.

    I used Wireshark Version 1.8.2 for verification in this article.

    1. Open the packet capture file with WireShark.
    2. From the menu, go to Telephony > VoIP Calls. The following panel opens.Wireshark-TelePhony-VoIPCalls.PNG
    3. Select the stream you want to verify and click the Flow button. The following signaling sequence appears.

    4. Find extendedVideoCapability (for the duo video, shown in the red box of the figure) among the OLC (Open Logical Channel) transmitted towards the terminal, and then click on it. The screen will transit to the corresponding packet on the WireShark packet list.

    1. You can see that the extendedVideoCapability packet is trying to use H.264 at Channel Number 64 and that the MCU IP address: port ( specifies media control channel and dynamic payload type of 96.
    2. You can also see "RTP (RTPType-96)" is located under OLC and the corresponding OLC ACK at Step.4. This is the duo video packets from MCU to the terminal.
    3. Click "RTP (RTPType-96)" to transit to the corresponding packet.

    1. NAL unit with "Sequence parameter set (7)" is the I-frame of H.264.Wireshark-H.264RTP-IframeDetail.PNG

    To decode H.264 RTP packets as H.264, open Edit > Preference from the WireShark menu. In this example, enter 96 in dynamic payload types for the H.264 protocol.


    Create the filter to search for I-frame as follows:

    1. Select the corresponding RTP packet.
    2. Right-click Source (IP address) of the Internet Protocol Layer, and then select Prepare a Filter > Selected from the menu.
    3. Right-click Source port of the User Datagram protocol layer, and then select Prepare a Filter > ... and Selected from the menu.
    4. Select NAL unit of the H.264 layer, and then select Prepare a Filter > ... and Selected from the menu.Wireshark-H.264RTP-IframeCreatingFilter.PNG
    5. As a result, the filter ((ip.src== && (udp.srcport == 55268)) && (h264.nal_unit_hdr == 7) will be created.

    You can now narrow down the I-frame among the duo video H.264 packets from MCU to the terminal using this filter.

    Related Information

    Original Document:
    Author: Junya Nishida
    Posted on April 24, 2013