 Re: rtmpdump as a plugin for wireshark
The easy answer is no, you cannot use this approach to decode rtmpe, rtmpte, or rtmps because you need the encryption keys in order to decode the streams, and those keys only existed in the Flash plugin's memory at the time the streams were created.
The harder answer is - if you can find the keys that the Flash plugin used, then it would be possible. Sometimes it's easier than others...
Also, this is why rtmpsuck exists; it acts as a man-in-the-middle so the rtmpe / rtmpte encryption are irrelevant.
|