RTMPT version 6 ?

RTMPT version 6 ?

 

Hi there,

I've bought a movie on VOD website (vodeo<dot>tv [FR]) and while watching it, I recorded it with tcpdump (referred to as [V]).
Now, my challenge is to extract the video data from the capture (.pcap) file.
I used chaosreader to extract the payload of each packet.
Now, I have many .data files and I need to find a way to extract/reassemble the FLV data.

I used wireshark and found that RTMPT was the protocol used to exchange data.
I first began studying RTMP protocol and read rtmpdump source code but there are several differences :
- rtmpdump doesn't send a "POST /fcs/ident2" (optional ?)
[then both send a "POST open/1" and the response is the <session id>]
- rtmpdump sends a "POST /send/<session id>/0" while [V] start with a "POST /iddle/<session id>/0" and then a "POST /send/<session id>/1" (idle command seem related to polling interval so uninteresting and is always 0x01 or 0x00)

I understand the first send command as the first part of the handshake (C0 and C1).
- for rtmpdump, C0 = 0x03 and C1 is 4 bytes for 'time' reference then 4 0x00 bytes then random bytes until the end
- for [V], C0 = 0x06 and C1 = 2 0x00 bytes then random bytes

And for S0 and S1, there are more differences :
- for rtmpdump, S0 should be 0x03 or 0x06 and S1 is 4 bytes for server time then 4 bytes for Flash Media Server version then random bytes
- for [V], S0 is 0x01 (???) followed by 0x06 then 4 (time ?) bytes then 0x03 0x00 0x02 0x01 (Flash Media Server version ?) then random bytes

I guess 'version' 6 is completly different from version 3 : C2 should be equal to S1 and S2 equal to C1 which is obviously not true in my case.

Any idea ?