[any ANONYMOUS forum user]

rtmpsrv allows you to get all parameters that are required by rtmpdump (http://all-streaming-media.com/record-video-stream/rtmpdump-freeware-console-RTMP-downloading-application.htm). You don't need packet sniffers or complex analysis to use rtmpdump when using rtmpsrv. The only problem you may have is when a video consists of several segments (chapters). In such cases just skip to the next chapter.

How to compile rtmpdump with rtmpsrv and rtmpsuck in Linux:
svn checkout svn://svn.mplayerhq.hu/rtmpdump/trunk rtmpdump
cd rtmpdump
make linux

How to use rtmpsrv in Ubuntu Linux:
Configure your firewall to redirect RTMP traffic through a local port:
sudo iptables -t nat -A OUTPUT -p tcp --dport 1935 -j REDIRECT
Then just start rtmpsrv:
./rtmpsrv
rtmpsrv will be analyzing data from your local port. It will output an rtmpdump command that can be used to download videos.

When you get the rtmpdump command, press CTRL+C. This will stop rtmpsrv.

You may also delete the firewall redirect created above:
sudo iptables -t nat -D OUTPUT -p tcp --dport 1935 -j REDIRECT

Since rtmpsrv produces rtmpdump command, the only thing you need to do is copy-paste it to download the video. Simple as it is :D

Note: If you don't need the latest version, you can install rtmpdump, rtmpsrv, rtmpsuck in Ubuntu by running the following in the terminal
sudo apt-get install rtmpdump
Then you don't need to navigate to the rtmpdump directory to launch rtmpdump or rtmpsrv or rtmpsuck.

[notty]

I can't thank you enough. This guide worked flawlessly. No more CooJah (http://all-streaming-media.com/record-video-stream/Blader-freeware-RTMP-downloader.htm) in virtual box for this guy. :)

[IKnowNothing]

Thanks for the instructions they worked - to a point at least.

I can get rtmpsrv to give me a command but when I try run it I get a failure due to a type 9 header.

Any ideas if there is a workaround?

[Stream Recorder]

Thanks for the instructions they worked - to a point at least.

I can get rtmpsrv to give me a command but when I try run it I get a failure due to a type 9 header.

Any ideas if there is a workaround?
rtmpdump does not start & error: HandShake: Type mismatch: client sent 6, server answered 9.

[sam4037]

This looks rather tasty and simple most of all! Time to get myself acquainted with Linux! Will start off with the Desktop edition of Ubuntu as suggested by Stream Recorder in this post (http://stream-recorder.com/forum/showpost.php?p=25524&postcount=8).

[chenxiaolong]

EDIT: I assume that everyone who has the bandwith to download RTMP streams has the bandwidth to view full images, so I didn't link to thumbnails. : )

So, in this tutorial, I'll show you how to download RTMP streams under Linux. In this tutorial, I'll going to be dumping a song from Napster (http://all-streaming-media.com/downloadable-audio-and-video/Napster-free-music-service.htm) (specifically, this one: hxxp://music.napster.com/london-symphony-orchestra,-antal-dor%C3%A1ti-music/album/enesco%3A-roumanian-rhapsody-no.1-_-liszt%3A-hungarian-rhapsodies-nos.1-6/12181167).

The first thing to do is to install RTMPdump (http://all-streaming-media.com/record-video-stream/rtmpdump-freeware-console-RTMP-downloading-application.htm) and gdb. You can do this with the package manager for your distro:

#Arch Linux:
pacman -Sy rtmpdump gdb
#Ubuntu and Debian
apt-get install rtmpdump gdb
#Fedora (with ATRpms repository: http://atrpms.net)
yum install rtmpdump gdb
#Mandriva and Mageia
urpmi rtmpdump gdb

If your distro doesn't provide binary packages, you will need to compile from source (Gentoo, Slackware, etc.).

We are going to be using rtmpsrv to generate the command needed to download the file. For rtmpsrv to work, you need to redirect all outgoing TCP connections to port 1935 on localhost. I suggest closing all unnecessary tabs and downloading programs. It will slow down rtmpsrv. Use iptables to redirect the connections. As root, run:

iptables -t nat -A OUTPUT -p tcp --dport 1935 -j REDIRECT

Then run as a normal user:

rtmpsrv

Before continuing, you should kill all flash player processes. It will make finding the PID easier later. To do that, run:

ps aux | grep flash

to list processes containing the string "flash" in the name. And then kill the processes by running: (replace 0000 with the PID. It's the second column of the previous command)

kill 0000

Now, browse to the page with the media file and start playing it. At this point, rtmpsrv has already generated the command for download the RTMP stream. The reason rtmpsrv couldn't automatically download the stream is because we told iptables to redirect ALL TCP connections to localhost on port 1935. An RTMP connection is a TCP connection, so essentially, it's trying to download from itself. So now, we have to remove that iptables rule. To do that, run:

iptables -t nat -D OUTPUT -p tcp --dport 1935 -j REDIRECT

(Notice that the iptables command uses "-D" instead of "-A". "-A" means add rule and "-D" means delete rule :))

Now, you can close rtmpsrv by pressing Control C and then copying and pasting that huge command starting with "rtmpdump -r ..." to download the stream.

What if that command fails?

Well, in this case we can dump the memory of the flash player process and search for the "rtmp" URI. Run:

ps aux | grep flash

to find the PID (second column) of the process:

http://i.imgur.com/GnMCf.png (http://imgur.com/GnMCf)

Now attach to the process with gdb (a free debugger):

http://i.imgur.com/KJoPv.png (http://imgur.com/KJoPv)

A lot of "Loading symbols" messages will fly by, and then you'll see this:

http://i.imgur.com/QfN4u.png (http://imgur.com/QfN4u)

Now type in "gcore" to perform a core memory dump of the process. It will create a file called core.PID.

http://i.imgur.com/au2kQ.png (http://imgur.com/au2kQ)

http://i.imgur.com/4PmhW.png (http://imgur.com/4PmhW)

Exit gdb by typing "quit." Type in "y" when it asks if you want to detach from the process. Now, open the core dump in a hex editor. I recommend using Okteta if you use KDE since it handle large files very well. The core dump will be at least 100MB. So, open the file in a hex editor:

http://i.imgur.com/WPUTi.png (http://imgur.com/WPUTi)

and search for the string (in Unicode or UTF-8) "rtmp://":

http://i.imgur.com/Qoatd.png (http://imgur.com/Qoatd)

Voila! There's the RTMP stream:

http://i.imgur.com/neFDZ.png (http://imgur.com/neFDZ)

Then, run the command generated by rtmpsrv again, but this time, replacing the generated stream URI with the one you found:

http://i.imgur.com/A6a3C.png (http://imgur.com/A6a3C)

Success! But since I can't post 11 images: http://i.imgur.com/M0acF.png

EDIT: Of course this all means nothing without proof: http://i.imgur.com/pqP6z.png

Hope this helps!

[chenxiaolong]

Works with RTMPE too! No more using Windows for downloading RTMPE!!

Screenshot: http://i.imgur.com/1b17E.jpg

[any ANONYMOUS forum user]

If your distro doesn't provide binary packages, you will need to compile from source (Gentoo, Slackware, etc.).
It is better to compile rtmpdump, rtmpsrv, rtmpsuck from the git, because the versions from the distro lack many updates.

[sam4037]

So, in this tutorial...

Rather tasty tutorial there. THANKS!

Can you let me know please what Linux that is that you are running?? What version or name and where to get it? It looks pretty slick!

Also, can I ask you some questions about the tutorial once I got the same Linux as you?

Thanks again! This whole iptables will probably be THE reason for me to not only test but actually start running on a Linux OS.

[hyc]

You're an ***.

If you're on Linux then follow the directions in the README file for using iptables with a proxy user. None of this gdb / coredump / hex edit crap is necessary.

[sam4037]

You're an ***.

If you're on Linux then follow the directions in the README file for using iptables with a proxy user. None of this gdb / coredump / hex edit crap is necessary.

As always, Howard rules! Thanks for letting me know, thought the tutorial was quite good, now I know different. Neither on Linux nor knowing much about iptables, but as I said this iptables and that things can be recorded while passing through it undetected by the server is quite damn neat, if I understood that right, so yeah, time to jump on the Linux train. Would it be possible for you to jot down a couple of commands for using iptables with a proxy user? i.e. Perhaps if you have time and could very kindly perhaps show an example with a couple of commands for iptables?

Also, Dear, Howard, if I may ask and you find time to very kindly reply, what version of Linux should I use for this but also for everyday office, email, surfing, but also media, video, audio, photo editing? Tried Ubuntu but that did not really catch my attention, perhaps try it again? So many questions, yes, plus I am a complete noob compared to you, so in all kindness, if would be great to hear back from you on those couple of questions. Thanks. And thanks for all your work on the seminal RTMPdump (http://all-streaming-media.com/record-video-stream/rtmpdump-freeware-console-RTMP-downloading-application.htm)!! :D

[hyc]

As always, Howard rules! Thanks for letting me know, thought the tutorial was quite good, now I know different. Neither on Linux nor knowing much about iptables, but as I said this iptables and that things can be recorded while passing through it undetected by the server is quite damn neat, if I understood that right, so yeah, time to jump on the Linux train. Would it be possible for you to jot down a couple of commands for using iptables with a proxy user? i.e. Perhaps if you have time and could very kindly perhaps show an example with a couple of commands for iptables?

The relevant commands are already in the README file. I wouldn't point anyone to that file if the full answer was not already there. Have you read it yet?

Also, Dear, Howard, if I may ask and you find time to very kindly reply, what version of Linux should I use for this but also for everyday office, email, surfing, but also media, video, audio, photo editing? Tried Ubuntu but that did not really catch my attention, perhaps try it again? So many questions, yes, plus I am a complete noob compared to you, so in all kindness, if would be great to hear back from you on those couple of questions. Thanks. And thanks for all your work on the seminal RTMPDump!! :D

I use Ubuntu (Xubuntu actually, but that's just personal taste).

[sam4037]

Howard, thanks for your reply. :)