rtmpdump as a plugin for wireshark

rtmpdump as a plugin for wireshark

 

hi,today,while i'm using rtmpdump, it give me an idea:is possible implement rtmpdump as a plugin of Wireshark?in wireshark there is a similar function for http,where when i navigate to site i can go from file->exports->object->http and show and save all the files that i've downloaded with http protocol....it's not possible make a similar function for rtmpdump using the traffic captured?

Re: rtmpdump as a plugin for wireshark

 

I didn't fully understand your post, but pretty sure this is what you want.

http://www.zap.org.au/software/utils...tract-rtmp-flv

Re: rtmpdump as a plugin for wireshark

 

exactly...there are many times when a user is registered to private courses,the videolessons can be see only one time on streaming and i can' t sniff the url,change the file hosts and make the procedure with rtmpsrv because is allowed only one time the connection for a url(and the first time is the more difficult because sometimes isn't tlee cleraly what is the protocol of trasmission)...the only solution is capture the stream with for Wireshark for example and make a program that make an flv file from the data sniffed and that don't make a new connection to the server...the link that you have posted is valid only for the normal rtmp ,but for rtmps and rtmpe?can you make a program that make a flv or mp4 file from data sniffed?

Re: rtmpdump as a plugin for wireshark

 

Jaksta in the recording mode and Orbit Grab Pro can capture RTMP packets from flash player.

Re: rtmpdump as a plugin for wireshark

 

yes but this program are not compatible with rtmpe,rtmps and rtmpte protocol...

Re: rtmpdump as a plugin for wireshark

 

The easy answer is no, you cannot use this approach to decode rtmpe, rtmpte, or rtmps because you need the encryption keys in order to decode the streams, and those keys only existed in the Flash plugin's memory at the time the streams were created.

The harder answer is - if you can find the keys that the Flash plugin used, then it would be possible. Sometimes it's easier than others...

Also, this is why rtmpsuck exists; it acts as a man-in-the-middle so the rtmpe / rtmpte encryption are irrelevant.

Re: rtmpdump as a plugin for wireshark

 

I not agree with you "hyc", the key can be found from the handshake data.

why?