script for extracting Flash video (FLV format) from RTMP stream captured by tcpdump

This PERL script by John Zaitseff extracts Flash video (FLV file format) from an RTMP stream captured by tcpdump. To capture the RTMP stream and extract it to an FLV video:

1. Run as root:
   

   tcpdump -i eth0 -p -s 0 -w file.tcpdump -v tcp src port 1935

2. As an ordinary user, open the relevant video URL in your browser window and start playback,
3. When the video finishes playing, quit the tcpdump program (using ^C),
4. Run this script as an ordinary user:
   

   extract-rtmp-flv file.tcpdump file.flv

This program is free software. You may distribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either Version 2 of the license, or (at your option) any later version.

[lupin]

this script support rtmpe rtmps and rtmpt protocols?there is a version compiled in perl for windows?

WinDump is the Windows version of tcpdump, the command line network analyzer for UNIX. WinDump is fully compatible with tcpdump and can be used to watch, diagnose and save to disk network traffic according to various complex rules. It can run under Windows 95, 98, ME, NT, 2000, XP, 2003 and Vista.

WinDump captures using the WinPcap library and drivers, which are freely downloadable from the WinPcap.org website. WinDump supports 802.11b/g wireless capture and troubleshooting through the CACE Technologies AirPcap adapter.


So you can capture with WinDump in Windows and then extract RTMP stream with the above mentioned PERL script.

[hyc]

You cannot use scripts like this to decode rtmpe or rtmps. Those streams are fully encrypted; without the keys you can't decrypt anything. That's why programs like rtmpsuck are necessary...

perl is an interpreted language, you don't compile it. The same script will run on any system with perl installed.

[overhill]

When I try this, I see the following output at the command line:

$ extract-rtmp-flv file.tcpdump file.flv
Parsing tcpdump output for file.tcpdump

extract-rtmp-flv: Unexpected tcpdump header line, line 1:
15:04:37.148997 IP (tos 0x0, ttl 53, id 0, offset 0, flags [DF], proto TCP (6), length 60)

I'm using:
tcpdump --version
tcpdump version 4.0.0
libpcap version 1.0.0

Any suggestions?

Thanks.