[Stavr0]

Originally Posted by noob2001204

I have been searching a tool that can let you redirect the traffic from rtmp server to rtmpsuck or rtmpsrv,so you can dump the stream much easier with both tools
Since windows host file cannot map ip address and another,it's needed to find another tool that can do the job
And I have found some tcp/udp redirection tools,but they simply do not work or maybe I just don't know what I should do to make them working.

I've found a way to intercept rtmp traffic under Windows. You need:

• Virtualizing software (VMware, Virtualbox or QEmu)
• A working guest OS running inside the VM
• the latest RTMPSUCK (rtmpdump 2.2b)

This requires you know what the rtmp URL is being called. Use something like TamperData extension to monitor URLs as they go by

In the VM's guest OS, make sure you can connect to the stream with the browser, ie have Flash installed etc..

Once you can SEE the stream, open the guest's VM HOSTS file (system32\drivers\etc\hosts) and create an IP address for the RTMP hostname, this must be the local IP address of your HOST OS (not VM)

IPCONFIG
Windows IP Configuration
Ethernet adapter virtualnet:
        Connection-specific DNS Suffix  . : local
        IP Address. . . . . . . . . . . . : 192.168.1.200
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1

NOTEPAD C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS

  hostpc 192.168.1.100 # this is my host pc
  guestvm 192.168.1.200 # this is my VM guest
  rtmpsrv.example.com  192.168.1.100 # rtmp://rtmpsrv.example.com/foo/bar/myfavoriteshow/?etc=&blahblah

On the HOST os, run

IPCONFIG
Windows IP Configuration
Ethernet adapter Ethernet:
        Connection-specific DNS Suffix  . : local
        IP Address. . . . . . . . . . . . : 192.168.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
RTMPSUCK -z   2> suck.log

this will create a huge file (several MBs)

back on the guest VM OS, restart the stream.

once you see the first seconds of video, kill everything, including rtmpsuck.

you should now have everyting you're looking for in SUCK.LOG.