Start with one authorized media session
Select one redacted SIM, logical channel and session interval. Correlate control-plane start and stop events with the media connection and preserve packet order. Remove real endpoints and identifiers from shared samples. Keep live and playback streams separate because their signaling, SSRC allocation and timing expectations can differ.
Decode the JT/T 1078 marker, packet sequence, packed SIM, channel and data/subpackage type first. Header fields after the base area depend on type. Validate multiple consecutive packets so a shifted boundary or wrong conditional layout cannot appear correct by chance.
Separate transport sequence from media timing
RTP sequence numbers diagnose order, gaps and duplicates within one SSRC. Handle 16-bit wraparound and distinguish late reordering from permanent loss. Capture loss before the observation point cannot be inferred. Compare sequence gaps with network counters and later packets before assigning a root cause.
RTP timestamps use a media clock, not wall time. Obtain the negotiated clock rate and group packets that share a timestamp for one frame or access unit. Regular but incorrectly scaled millisecond values often indicate the wrong clock assumption. Marker usage and fragmentation profile provide additional frame-boundary context.
Reconstruct payload before scanning PS
Remove the actual RTP header, including CSRC entries and extensions, and reconstruct payload bytes in sequence order according to the transport profile. Only then scan for MPEG-PS pack, system, map and PES start codes. A 000001 pattern is a boundary clue; declared lengths and surrounding syntax must still be validated.
Packet loss can break a PS section far from the visible decoder error. Record the RTP sequence range contributing to every reconstructed region. This connects a malformed PES or missing program-stream map to the transport gap that caused it.
Identify H.264 boundaries without overclaiming
After PS and PES extraction, determine whether the elementary stream uses Annex-B start codes or length-prefixed AVC. For Annex-B, locate SPS, PPS, IDR, non-IDR slices and other NAL types. Parameter sets should be available before dependent pictures, but NAL type alone does not validate bitstream syntax or decoding success.
Preserve the first failure interval as a layered regression sample: signaling metadata, JT/T header, RTP sequence/timestamp, reconstructed PS offsets and H.264 unit list. This makes later fixes test the actual dependency chain rather than one isolated parser.
Use a layer-by-layer incident record
Record which layer first violates an invariant: authorized session mapping, JT/T header, packet sequence, media clock, RTP payload offset, PS length or codec boundary. A later decoder symptom should not replace the earliest reproducible failure as the root-cause candidate.