How to find rtmp:// stream URL: Software to sniff, snoop RTMP links

[noob2001204]

what software tools you use to find/sniff/snoop rtmp:// stream URL?

[compn]

Freeware URL Snooper can pick up some of the stream by adding rtmp;netstream;playing to the 'Also search for' box


you get some results like:

tcUrl... rtmp://oijqodbttndn.rtmphost.com/hostelworld

and

play... paris_hipotelbellville

put them together:

rtmp://oijqodbttndn.rtmphost.com/hostelworld/paris_hipotelbellville.flv

Freeware Orbit Grab++

[any ANONYMOUS forum user]

Originally Posted by compn

Freeware URL Snooper can pick up some of the stream by adding rtmp;netstream;playing to the 'Also search for' box

Is there a way to find the complete RTMP URL like

rtmp://oijqodbttndn.rtmphost.com/hostelworld/paris_hipotelbellville.flv

in the raw dump?

Could URL Snooper be used to find/assemble this RTMP stream URL automatically ?

[compn]

There is no way to find that string in the packet dump. Most sites don't work like that. Some sites use xml playlists which work well.

With URL Snooper... It wasnt made for flash streaming (RTMP). You'd have to ask the developer if he plans to do it.

How to find RTMP stream URLs
by Peter Thomas

When it comes to downloading flash streams from the internet, Wireshark can be used to sniff out the values you need.

Let’s take this site for example: http://videolectures.net/

Start a Wireshark capture session before clicking on a video on the site to play it. Let WireShark grab all the information exchanged between your PC and the remote flash server and you can stop the capture once the video begins to play, we are only interested in what goes on during the connection handshake. I will use this video as an example: http://videolectures.net/ff06_chomsky_szmp/ [update Jun-2008: looks like they changed this particular video to Windows media instead of Flash, so try other videos or other sites]

In WireShark you can filter for protocol “rtmpt” and the first few entries would be handshake or “invoke” operations. Examining the “Handshake part 3″ we can easily get the value of the required “app” property. Below we can see it is “video/2006/other/ff06/chomsky_noam”:



For the host name, the IP address should do fine for most sites, but we can easily figure out the host name of the stream server from what appears after “rtmp://”. Note that WireShark allows you to search the text contents of captured packets. Here below we can see that the host name is “velblod.videolectures.net”:



And finally when the “play” command is issued – we need the value of the stream name. Below we see it is “chomsky_noam_01″:



So with the right values of hostname, app and stream name set – you can run the program and download the stream to your local drive for offline viewing. To download the whole stream – just change the duration to ‘-2′ as hinted in the source code comment. There are many free Flash players available you can use to play downloaded content.

Do let me know if this works for you and if you find any additional parameters that need to be passed for other sites.

RTMP URLs contain an application and stream name - there is no way to tell from the URL which parts of a path are the stream name and which are the application.

For example with this URL:

rtmp://cp40359.edgefcs.net/ondemand/fancast/Comcast_CIM_Prod_Fancast_Partner/821/651/COMEDYCENTRAL_COLBERTREPORT_4118.flv

The application is

rtmp://cp40359.edgefcs.net/ondemand/fancast

and the stream name is

Comcast_CIM_Prod_Fancast_Partner/821/651/COMEDYCENTRAL_COLBERTREPORT_4118.flv

Most Flash based media players deal with this by trying again and again with different prefixes of the URL until they find the one that works.

CooJah + Blader are handy for finding RTMP URLs.

If you right click on an RTMP URL in CooJah


and select "Download by Blader", Blader will show a dialog window not only with the RTMP URL, but also with swfURL, tcURL, playpath

NetTransport comes with a URL sniffer that can find RTMP stream URLs as well. This only works in a shareware version, not the last freeware one.

[worktest]

How did you find this rtmp URL?

Thanks you,

Originally Posted by Stream Recorder

RTMP URLs contain an application and stream name - there is no way to tell from the URL which parts of a path are the stream name and which are the application.

For example with this URL:

rtmp://cp40359.edgefcs.net/ondemand/fancast/Comcast_CIM_Prod_Fancast_Partner/821/651/COMEDYCENTRAL_COLBERTREPORT_4118.flv

The application is

rtmp://cp40359.edgefcs.net/ondemand/fancast

and the stream name is

Comcast_CIM_Prod_Fancast_Partner/821/651/COMEDYCENTRAL_COLBERTREPORT_4118.flv

Most Flash based media players deal with this by trying again and again with different prefixes of the URL until they find the one that works.