[ertes]

Hi guys, a new user here! :D
Without losing time, my question:
I always use external software for download RTMP, but now i want to learn the "manual" way
With WireShark i'll search for rtmpt and follow UTP stream. I'll found the rtmp:\\ link, but sometime has a few more "dots":

Example:
rtmp://justintvlivefs.fplive.n.et/justintv2live-live

Instead of
rtmp://justintvlivefs.fplive.net/justintv2live-live

In Wireshark i can find also other parameter like swfUrl, tcUrl etc. but if they has more "dots" it's hard to understand where remove it

Now for what i have understand rtmpsrv/rtmpsuck are used for find other parameter of a RTMP stream, but how?
My host is Windows XP

Thanks for any explaination

[karlo2105]

Put the link of stream.

[ertes]

Thanks for your post, but i'll repeat:
I don't want an help for download the video ( i have post an example, searching around ) but a guide for use rtmpsrv/rtmpsuck for the other parameter on XP

The RTMP ( live resource ):
rtmp://justintvlivefs.fplive.net/justintv2live-live/stream_360p_user_xboct

Link
http://it.twitch.tv/xboct

[oelk]

[I assume, you meant TCP instead of UTP.]
These dots occuring in the Wireshark output of the raw stream are "control" bytes. They arre necessary for the decoding of rtmp messages and chunks.
To get rid of them, Wireshark decodes (in most cases) the messages. After you follows the stream, there should be some lines with procotol RTMP in the main window. To find the parameters, you just have to find the packages with 'connect' and 'play' commands (Sometimes also some of the packages between).

I think rtmpsrv/rtmpsuck for Windows is not really useful. rtmpsrv should work to get the parameters, but it's not worth the work.
Use rtmpsuck on Linux (maybe within a VirtualBox) to have fun with it. You'll find some good tutorials, if you search for them.

[ertes]

Yeah oelk, TCP
I have found the packages with 'connect' and 'play' commands, but they have additional dots, one of two max.

If i add a wrong parameter with more dots, i can't download the video
Example, this line is swfUrl:
www-cdn.jtvnw.net/widgets/live_site_.player.rcd6bfe2fdc9b8ef76b0d85a8b48474e 9d5cf72c6.swf?&referer=http://it.twitch.tv/xboct&userAgent=Mozilla/5.0%20(Windows%20NT%20.5.1)%20AppleWebKit/537.1%20(KHTML,%20like%20Gecko)%20Chrome/21.0.1180.60%20Safari/537.1
Have 2 dots in plus, can you tell me where they are? :D

rtmpsuck exist for Windows, why i need to use Linux? Anyways i need only the parameter, so if i can do it with rtmpsrv is the same

[oelk]

The dots are only in the raw data. Wireshark decodes most of the packets. If you click these decoded packets, you'll easily find the parameters without dots. If Wireshark doesn't decode the packets you could do this manually using the rtmp specification to get rid of the 'dots'. But this is really time-consuming :D

I didn't say, that you have to use Linux. It's just more comfortable to use rtmpsrv/rtmpsuck there (i.m.h.o.). With Windows I can't help you ;)

Btw: Often the parameter swfPath isn't necessary.

[ertes]

Understood, thanks fro your help ;)

[oelk]

You're almost done. Just close this window and you'll find what you need in the main window. It should now look like this:
http://postimage.org/image/igjap4sqz/