How to Use FFmpeg to Capture and Record RTSP Streams from IP Cameras

In the context of the Ukraine cyber‑war, the Ukrainian military tasked us with accessing IP cameras inside Ukraine to monitor Russian forces. The article demonstrates how FFmpeg can be leveraged to process the RTSP video streams from those cameras.

What FFmpeg Is

FFmpeg is a leading open‑source multimedia framework. The "FF" stands for "Fast Forward" and "MPEG" refers to the Moving Picture Experts Group. Created in 2000 by Fabrice Bellard, it has grown from a simple codec tool into a versatile platform for converting virtually any video stream.

Installing FFmpeg

sudo apt update
sudo apt install ffmpeg

After installation, verify the version with:

ffmpeg -version

Reading an RTSP Stream

FFmpeg can decode RTSP/RTP streams and either save or convert them. The simplest command to capture a stream is:

ffmpeg -i rtsp://username:password@camera_ip:554/stream -c copy output.mp4

The -i option specifies the RTSP URL, while -c copy copies the audio and video streams without re‑encoding, maximizing speed. If connection problems arise, forcing TCP transport often helps:

ffmpeg -rtsp_transport tcp -i rtsp://username:password@camera_ip:554/stream -c copy output.mp4

TCP ensures reliable packet delivery, which is useful on unstable networks where UDP packets may be lost.

Capturing a Screenshot from the Stream

To capture a single frame:

ffmpeg -rtsp_transport tcp -i rtsp://username:password@camera_ip:554/stream -frames:v 1 screenshot.jpg

If the stream does not require authentication, the URL can omit credentials. To avoid naming conflicts with image‑sequence expectations, use a patterned filename:

ffmpeg -rtsp_transport tcp -i rtsp://camera_ip:554/stream -frames:v 1 screenshot_%03d.jpg

For periodic screenshots based on timestamps, combine a video filter with strftime formatting:

ffmpeg -rtsp_transport tcp -i rtsp://camera_ip:554/stream -vf "fps=1/10" -strftime 1 "screenshot-%Y%m%d-%H%M%S.jpg"

The -vf "fps=1/10" filter tells FFmpeg to output one frame every ten seconds.

Strategic Implications

Compromising IP cameras is not merely voyeuristic; it offers strategic and national‑security advantages. Controlling access to widely deployed cameras provides a decisive edge in reconnaissance and data acquisition.