[HansMayer]

Hi,
I've captured a stream with wireshark. Now I want to extract the video from it, but all my tries failed. I've found a extract-rtmp-flv perl script here, but it can't read the dump either:
Unexpected tcpdump header line, line 1:
?????A?iOz?

Any infos on this?

[Bahman]

Nothing useful, webpage link?

[KSV]

Hi,
I've captured a stream with wireshark. Now I want to extract the video from it, but all my tries failed. I've found a extract-rtmp-flv perl script here, but it can't read the dump either:
Unexpected tcpdump header line, line 1:
?????A?iOz?

Any infos on this?

make sure that you save the caputre file in tcpdump format. any particular reason to use such obsolete way of capturing video? why don't you use rtmpsrv or rtmpsuck instead?

[HansMayer]

Nothing useful, webpage link?
Of the file on my desktop? file:///Users/USERNAME/Desktop/capture.wireshark
Hope it helps.
make sure that you save the caputre file in tcpdump format. any particular reason to use such obsolete way of capturing video? why don't you use rtmpsrv or rtmpsuck instead?
I had that file already captured. I've tried to save the file as Wireshark/tcpdump/..., Modified tcpdump, Redhat 6.1 tcpdump, SuSE 6.3 tcpdump. None worked.

[svnpenn]

I dont think you get it. If you want help, INCLUDE THE LINK FROM THE WEBPAGE CONTAINING THE STREAM.

[HansMayer]

I dont think you get it. If you want help, INCLUDE THE LINK FROM THE WEBPAGE CONTAINING THE STREAM.
Well, you neither: You won't be able to recapture the stream from last night again.
I can use rtmpsuck on the currently playing stream myself, but that's not the issue here. Or did you want to show me something else?

[svnpenn]

You won't be able to recapture the stream from last night again

If that be the case, then you need to make a full upload of your capture, and link to it here, if you really want help.

[HansMayer]

Capture any RTMPT stream in Wireshark yourself. If you've figured out how to extract the stream, tell me how you did it. The stream itself makes no difference.

[svnpenn]

Capture any RTMPT stream in Wireshark yourself

If you cant be bothered to do one of the following

* Upload your capture
* Upload an RTMPT capture
* Link to a public RTMPT stream

then I cant be bothered to help you

[HansMayer]

If you cant be bothered to do one of the following

* Upload your capture
* Upload an RTMPT capture
* Link to a public RTMPT stream

then I cant be bothered to help you
Yeah, still no. Any capture is as good as mine.
When I've figured out a solution, I will update this for anyone who might be in the same situation, though.

Thanks anyways.

[svnpenn]

Yeah, still no. Any capture is as good as mine

Make things easy for the recipient.
ietf.org/rfc/rfc1855

These guidelines have been around for over 20 years.

When asking for help, it is best to "make things easy" for the people whom you are asking. Saying something to the effect of "do the capture yourself" is quite the opposite of that, and unlikely to attract any help.

Regards

[HansMayer]

Unless you are using an encryption device (hardware or software),
you should assume that mail on the Internet is not secure. Never
put in a mail message anything you would not put on a postcard.
:rolleyes:

Again, any Wireshark capture is as good as mine.
Sorry for the inconvenience of hitting the record button and opening a random stream for 5 seconds (which should be a fraction of the time it took to post three requests for the dump and would've been much more convenient on your end). The perl script didn't work with any dump I tried, captured under different OS, with both Wireshark and tcpdump.
If you'd know how to do it, you could give a brief explanation without the need for any additional data in the first place. That leaves me with the conclusion that whether I'd post something on not, it wouldn't make any difference. At least in terms of archiving my goal of extracting the stream.

[svnpenn]

If you'd know how to do it, you could give a brief explanation without the need for any additional data in the first place.

There are thousands of websites using the RTMP protocol, each with their own little quirks, hence the need for this forum and the RtmpDump mailing list.

That leaves me with the conclusion that whether I'd post something on not, it wouldn't make any difference. At least in terms of archiving my goal of extracting the stream.

stream-recorder.com/forum/announcement.php?f=4

If you would show some simple courtesy to these FORUM RULES as well as general netiquette instead of rolling your eyes, you might get an answer.

[HansMayer]

There are thousands of websites using the RTMP protocol, each with their own little quirks, hence the need for this forum and the RtmpDump mailing list.



stream-recorder.com/forum/announcement.php?f=4

If you would show some simple courtesy to these FORUM RULES as well as general netiquette instead of rolling your eyes, you might get an answer.
RULES do not apply to HansMayer in general, but I assume you mean this:
In the thread title please include the following

web-site name (if possible),
stream format and protocol (if you know them)
if your question is related to a single stream capture software, please mention the name of this software


Include links to web-pages with streaming videos
Include web-site name, stream format and protocol into the thread title.
Include stream ripper software name for product specific questions.
Indicate version of stream capture software that you use.



Not possible.
FLV/RTMP
Wireshark/tcpdump 4.1.1 (libpcap 1.1.1)


N/A
N/A, FLV, RTMP
Does not apply
Wireshark/tcpdump 4.1.1 (libpcap 1.1.1)

Please state how to exact any RTMPT stream from a pcap, and I'll figure out the rest.
You won't get access to the stream or any files that would expose it, regardless of how hard you try. And all I want is having the stream extracted from a pcap. If you don't want to help me with this, it's cool. But don't try to pull off any trick in the book just because I'm denying you the access.

Apply common sense "reality checks" before assuming a message is valid.
:rolleyes:

[svnpenn]

:rolleyes:

You came to us for help, remember that. If you cant or wont abide by a simple request for more information regarding your question, then that is YOUR problem.

[HansMayer]

I asked: I have a book. My tools to read it don't work. How to read it?
I was getting these answers, in the following order:

Not helping, please post the address of the library.
Make sure it's in English. Why aren't you reading it as an E-Book? (the only helpful and valid answer thus far)
Please post the address of the library, as well as a copy of the book (pcap) along with you library card number (the user credentials in the pcap), a copy of your driver's license (IP with timestamps in the pcap) and your birth certificate (MAC address in the pcap).

Do you understand this analogy, or do I have to rephrase? A Prius is as good as a Dodge if you want to lern how to drive seems to be a little hard on you.

And well, as I introduced you to the problem, it's perfectly logic that it's mine. That's not the issue here, but how to resolve it.

There are thousands of websites using the RTMP protocol, each with their own little quirks, hence the need for this forum and the RtmpDump mailing list.
Yet, I haven't seen one (1) of them as an example to adapt to my problem.

Thank you so much for your help, I really appreciate it. :rolleyes:

[svnpenn]

I asked: I have a book.

I dont need a metaphor, heres reality

* someone posts question on the forum, blatantly disregard rules
* when asked for more info regarding problem, refuses
* flurry of snide remarks and eyerolling from OP

= no help

[HansMayer]

I agree, at least with the third argument and the "no help" part.
1) Is complete BS, I've given all the data needed to resolve the problem more than once. Nor do rules exist in my reality, nor did I see any that would've been disregarded by me if I would adhere to them in the first place.
2) Is not needed as the video data in an RTMP stream adheres to standards,
3) Is true, but that started that after you quoted things that discredited you on the top half of the first page.

[svnpenn]

Nor do rules exist in my reality

Mate, no one cares about your reality.

This is the real world, and the people that run this forum put these rules in place to make an effective environment of questions and answers. You or anyone disregarding them because it is your preference or any other reason wastes

* your time
* my time
* anyone else that stumbles across your trainwreck of a thread

do yourself any everyone else a favor and just stop posting until you can respect that.

[HansMayer]

The solution:
our $debug_ascii_in = 1; # True to assume tcpdump is in ASCII
(Line 55 of the extract-rtmp-flv perl script) Change it to 0, and it works with pcaps. That is, of course, any of them.

How that would've required posting the pcap and the page url is still beyond me. :rolleyes:

Again, I don't care about rules, nor did I break any of the ones you stated. If you can't think for yourself and need other people to tell you what's right or wrong, that's a bummer.