View Single Post
  #6  
Old 06-06-2010, 11:18 PM
hyc hyc is offline
RTMPdump team
 
Join Date: Dec 2009
Posts: 169
hyc will become famous soon enoughhyc will become famous soon enough
Default

Re: rtmpdump as a plugin for wireshark


The easy answer is no, you cannot use this approach to decode rtmpe, rtmpte, or rtmps because you need the encryption keys in order to decode the streams, and those keys only existed in the Flash plugin's memory at the time the streams were created.

The harder answer is - if you can find the keys that the Flash plugin used, then it would be possible. Sometimes it's easier than others...

Also, this is why rtmpsuck exists; it acts as a man-in-the-middle so the rtmpe / rtmpte encryption are irrelevant.
Reply With Quote