How to find/sniff/snoop rtmp:// stream URL with freeware Wireshark

How to find RTMP stream URLs
by Peter Thomas

When it comes to downloading flash streams from the internet, Wireshark can be used to sniff out the values you need.

Let’s take this site for example: http://videolectures.net/

Start a Wireshark capture session before clicking on a video on the site to play it. Let WireShark grab all the information exchanged between your PC and the remote flash server and you can stop the capture once the video begins to play, we are only interested in what goes on during the connection handshake. I will use this video as an example: http://videolectures.net/ff06_chomsky_szmp/ [update Jun-2008: looks like they changed this particular video to Windows media instead of Flash, so try other videos or other sites]

In WireShark you can filter for protocol “rtmpt” and the first few entries would be handshake or “invoke” operations. Examining the “Handshake part 3″ we can easily get the value of the required “app” property. Below we can see it is “video/2006/other/ff06/chomsky_noam”:



For the host name, the IP address should do fine for most sites, but we can easily figure out the host name of the stream server from what appears after “rtmp://”. Note that WireShark allows you to search the text contents of captured packets. Here below we can see that the host name is “velblod.videolectures.net”:



And finally when the “play” command is issued – we need the value of the stream name. Below we see it is “chomsky_noam_01″:



So with the right values of hostname, app and stream name set – you can run the program and download the stream to your local drive for offline viewing. To download the whole stream – just change the duration to ‘-2′ as hinted in the source code comment. There are many free Flash players available you can use to play downloaded content.

Do let me know if this works for you and if you find any additional parameters that need to be passed for other sites.