Extract rtmp stream from Wireshark capture

HansMayer · #1 03-21-2012, 06:15 AM

Hi,
I've captured a stream with wireshark. Now I want to extract the video from it, but all my tries failed. I've found a extract-rtmp-flv perl script here, but it can't read the dump either:

Code:

 Unexpected tcpdump header line, line 1:
?????A?iOz?

Any infos on this?

Bahman · #2 03-21-2012, 07:36 AM

Nothing useful, webpage link?

KSV · #3 03-21-2012, 07:50 AM

Quote:

Originally Posted by HansMayer

Hi,
I've captured a stream with wireshark. Now I want to extract the video from it, but all my tries failed. I've found a extract-rtmp-flv perl script here, but it can't read the dump either:

Code:

 Unexpected tcpdump header line, line 1:
?????A?iOz?

Any infos on this?

make sure that you save the caputre file in tcpdump format. any particular reason to use such obsolete way of capturing video? why don't you use rtmpsrv or rtmpsuck instead?

HansMayer · #4 03-21-2012, 09:16 AM

Quote:

Originally Posted by Bahman

Nothing useful, webpage link?

Of the file on my desktop? file:///Users/USERNAME/Desktop/capture.wireshark
Hope it helps.

Quote:

Originally Posted by KSV

make sure that you save the caputre file in tcpdump format. any particular reason to use such obsolete way of capturing video? why don't you use rtmpsrv or rtmpsuck instead?

I had that file already captured. I've tried to save the file as Wireshark/tcpdump/..., Modified tcpdump, Redhat 6.1 tcpdump, SuSE 6.3 tcpdump. None worked.

svnpenn · #5 03-21-2012, 04:18 PM

I dont think you get it. If you want help, INCLUDE THE LINK FROM THE WEBPAGE CONTAINING THE STREAM.

HansMayer · #6 03-21-2012, 06:13 PM

Quote:

Originally Posted by svnpenn

I dont think you get it. If you want help, INCLUDE THE LINK FROM THE WEBPAGE CONTAINING THE STREAM.

Well, you neither: You won't be able to recapture the stream from last night again.
I can use rtmpsuck on the currently playing stream myself, but that's not the issue here. Or did you want to show me something else?

svnpenn · #7 03-21-2012, 06:24 PM

Quote:

Originally Posted by HansMayer

You won't be able to recapture the stream from last night again

If that be the case, then you need to make a full upload of your capture, and link to it here, if you really want help.

HansMayer · #8 03-21-2012, 06:42 PM

Capture any RTMPT stream in Wireshark yourself. If you've figured out how to extract the stream, tell me how you did it. The stream itself makes no difference.

svnpenn · #9 03-21-2012, 06:56 PM

Quote:

Originally Posted by HansMayer

Capture any RTMPT stream in Wireshark yourself

If you cant be bothered to do one of the following

* Upload your capture
* Upload an RTMPT capture
* Link to a public RTMPT stream

then I cant be bothered to help you

HansMayer · #10 03-21-2012, 08:01 PM

Quote:

Originally Posted by svnpenn

If you cant be bothered to do one of the following

* Upload your capture
* Upload an RTMPT capture
* Link to a public RTMPT stream

then I cant be bothered to help you

Yeah, still no. Any capture is as good as mine.
When I've figured out a solution, I will update this for anyone who might be in the same situation, though.

Thanks anyways.