Peter Thomas,
I've tried to use
Wireshark to capture a video on:
Code:
http://www.five.tv/shows/eddie-stobart-trucks-trailers/episodes/episode-4-135
When I saw no rtmp packets, I did the following:
The first item to check: is the RTMP using the standard port 1935 in this capture? If not, tell WireShark how to decode it (see last step below).
The second item to check: turn on heuristics Edit → Preferences → Protocols → TCP → Try heuristic sub-dissectors first: FAILED.
If all else fails, brute force: right-click one of the packets → Decode As... → RTMP
I've saved the third step's results but can't send it as it's 11MB. There are handshakes but I don't see the first (or second part) of the video's URL. Should I use the Destination IP?
I'm not able to see the second part of the URL?
Any ideas?
John