Challenge: decode stream url & token from wireshark logs

benstewart · #1 12-15-2014, 10:06 AM

Hi,

I'm probably close to get the right rtmp stream from the wireshark log above (tcp stream got when starting to play the stream in the browser) but I can't figure it out.

For example, which of the following urls is the good one?

Code:

rtmp://185.39.11.50:1735/vod?token=play@141867678301507

or

Code:

 rtmp://stream.dinozap.tv:190/vod/_definst_/jerkoooo_7w4bxhm

I've got the securetoken "wowk" found in http://www.playerhd2.pw/embed.php[...]. But I couldn't play the stream with rtmpdump, it keeps connecting.

Can anyone help me get the right url/token and the appropriate rtmpdump cmd? I would be SO grateful, after tens of hours scratching my head on this.

Ben

Wireshark log:

Code:

app...vod?token=play@141867678301507..flashVer...LNX 14,0,0,177..swfUrl..?http://www.spasswitz.com/jwplaye.r5/addplayer/jwplayer.flash.swf..tcUrl..7rtmp://185.39.11.50:1735/vod?token=play@141867678301507..fpad....capabilities.@m.........audioCodecs.@.........videoCodecs.@o.......
videoFunction.?.........pageUrl...http://www.playerhd2.pw/embed.php?c=28128&width=6.40&height=360&autostart=true&tk1=sn4WSXP%2Fp8XsII3DOMbwVRqHrw%2F22BL7q0Q4kw6hHPg%3D&tk2=6xuruBy80vR%2BIGKfSw1GYMyrFQTJaUEORTttWZ.md4%2Bc%3D&tk3=mjBe441UKwCthV6aca5WMXNN0aPx4%2FENUtmg9VWq5UI%3D..objectEncoding.........................&%..............&%..................................................._result.?..........fmsVer...FMS/3,5,5,2004..capabilities.@?........mode.?.............level...status..code...NetConnection.Connect.Success..description...Connection succeeded...data.......version..
3,5,5,2004.....clientid.A...z.....objectEncoding.........................&%....W...........createStream.@........B.....
.........................._result.@.........?..........X..$........play.............jerkoooo_7w4bxhm............................................onStatus.............level...status..code...NetStream.Play.Reset..description..RPlaying and resetting rtmp://stream.dinozap.tv:190/vod/_definst_/jerkoooo_7w4bxhm...clientid.A...z.....................onStatus.............level...status..code...NetStream.Play.Start..description..LStarted playing rtmp://stream.dinozap.tv:190/vod/_definst_/jerkoooo_7w4bxhm...clientid.A...z....
isFastPlay....timecodeOffset..
104356640L...E..........|RtmpSampleAccess..........,........onStatus...code...NetStream.Data.Start................ ....E.........
onMetaData...author.....copyright.....description.....keywords.....rating.....title....
presetname...Custom..creationdate...Sat Dec 13 20:12:44 2014..videodevice...XSplitBroadcaster..framerate.@>........width.@.........height.@v........videocodecid...avc1..avclevel.@>.......
avcprofile.@Y.......
videodatarate.@xj.......videokeyframe_frequency.?h.t.j~...audiodevice..
VHAudioCustom..audiosamplerate.@.@......
audiochannels.?.........audioinputvolume.@Y........audiocodecid.@&.......
audiodatarate.@;&......
bufferSize...500k.
maxBitrate...500k..xsplitBroadcasterVersion...1.3.0.238..xsplitCoreVersion...1.3.1403.1202 Version 1.3..xsplitGameSourceVersion...1.1.1.117..xsplitMediaLibVersion...2.0.0.324.
pluginName..
CustomRTMP.

Rtmpdump:

Code:

rtmpdump -r "rtmp://stream.dinozap.tv:190/vod/_definst_/jerkoooo_7w4bxhm" -a "flash" -W "http://www.spasswitz.com/jwplaye.r5/addplayer/jwplayer.flash.swf" -T "wowk" -o test.flv -z -v
RTMPDump v2.4
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
ERROR: RTMP_HashSWF: swfurl http://www.spasswitz.com/jwplaye.r5/addplayer/jwplayer.flash.swf not found
DEBUG: Protocol : RTMP
DEBUG: Hostname : stream.dinozap.tv
DEBUG: Port     : 190
DEBUG: Playpath : jerkoooo_7w4bxhm
DEBUG: tcUrl    : rtmp://stream.dinozap.tv:190/flash
DEBUG: swfUrl   : http://www.spasswitz.com/jwplaye.r5/addplayer/jwplayer.flash.swf
DEBUG: app      : flash
DEBUG: live     : yes
DEBUG: timeout  : 30 sec
DEBUG: Setting buffer time to: 36000000ms
Connecting ...

biezom · #2 12-15-2014, 11:45 AM

it's the same issue

HTML Code:

http://stream-recorder.com/forum/help-please-site-t19008.html

to solve read this

HTML Code:

http://stream-recorder.com/forum/showpost.php?p=72304&postcount=315

for me it works after compile with gorilla.maguila's modification

biezom · #3 12-15-2014, 11:51 AM

can you post original link's chanel please for try?

benstewart · #4 12-16-2014, 04:34 PM

Thank @biezom, I truly appreciate your help.

* Which version of rtmp(.c) do you use? I can't find the lines mentionned by gorilla.maguila in the latest version on https://rtmpdump.mplayerhq.hu. For example redirected does not belong to RTMP_LNK struct.

* The -p param gives the web path and its token. Even if I successfully rtmpdump the stream, will I need a new token everytime (If so I can't reuse the stream in ajwplayer right) ?

thanks again, Ben

biezom · #5 12-16-2014, 04:42 PM

can you post original link's chanel please for try if it works i'm not sure!!

benstewart · #6 12-16-2014, 04:49 PM

sure, channel: http://polysportstv.net/live/tv.php?...640&height=360

(ignore my Q1, I've successfully installed rtmpdump's patch)

biezom · #7 12-16-2014, 05:01 PM

ok it works
but it works just one time, for an other time you need sniff again for a new link

benstewart · #8 12-16-2014, 05:12 PM

My last 2 questions, I swear.

Do you use wireshark to find the rmtp info or is there anything easier?
Is there an easy way to forward the caught stream with rtmpdump to my own rtmp server ?

Ben

biezom · #9 12-16-2014, 05:19 PM

i'm on debian linux not on windows. i use iptables and rtmpsrv in terminal. On windows i think you can use rtmpdumphelper and firefox

benstewart · #10 12-17-2014, 04:05 AM

Hi biezom,

I'm also on Debian. When I do:

sudo iptables -t nat -A OUTPUT -p tcp --dport 1735 -j REDIRECT --to-port 1935
rtmpsrv
watch in the browser http://polysportstv.net/live?ch=3

I successfully get the rtmpdump command, then I flush the iptables rules. When I launch the rtmpdump command, the server rejects me.

What am I missing? Does it work on your side?

Get the RTMP command:

Code:

./rtmpsrv
RTMP Server v2.4
(c) 2010 Andrej Stepanchuk, Howard Chu; license: GPL

Streaming on rtmp://0.0.0.0:1935
WARNING: Trying different position for client digest!

rtmpdump -r "rtmp://185.39.10.134:1735/redirect/" -a "redirect/?token=play@141883511703666" -f "LNX 11,2,202,425" -W "http://www.spasswitz.com/jwplayer5/addplayer/jwplayer.flash.swf" -p "http://www.playerhd2.pw/embed.php?c=28128&width=640&height=360&autostart=true&tk1=EoIDYJhisqAyhTuDnQVDx2wbMKlk7b594sPSFQ1txB0%3D&tk2=RJf1qQRTaTQoGtU783KcO7HQmPzNxiQ0KEUGquhbom4%3D&tk3=00%2BWU6PNzKb%2FXN9kR3E%2BJaiGndT7%2FFUp%2BG9YlZhzEVU%3D" -y "jerkoooo_7w4bxhm" -o "2014-12-17_10-55-48_jerkoooo_7w4bxhm.flv"

Closing connection... done!

Play it just after:

Code:

./rtmpdump -r "rtmp://185.39.10.134:1735/redirect/" -a "redirect/?token=play@141883511703666" -f "LNX 11,2,202,425" -W "http://www.spasswitz.com/jwplayer5/addplayer/jwplayer.flash.swf" -p "http://www.playerhd2.pw/embed.php?c=28128&width=640&height=360&autostart=true&tk1=EoIDYJhisqAyhTuDnQVDx2wbMKlk7b594sPSFQ1txB0%3D&tk2=RJf1qQRTaTQoGtU783KcO7HQmPzNxiQ0KEUGquhbom4%3D&tk3=00%2BWU6PNzKb%2FXN9kR3E%2BJaiGndT7%2FFUp%2BG9YlZhzEVU%3D" -y "jerkoooo_7w4bxhm" -o "2014-12-17_10-55-49_jerkoooo_7w4bxhm.flv"
RTMPDump v2.4
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
Connecting ...
INFO: Connected...
INFO: rtmp server sent redirect
INFO: trying to connect with redirected url
ERROR: rtmp server sent error
ERROR: rtmp server requested close