tagesschau.de: Problems recording RTMP traffic with WireShark

[danix99]

Hi Folks.

I know Replay Media Catcher, but want to bring up my own solution.
The journey is the reward...

I'm currently trying to decode rtmp traffic on Port 1935.
Simple trick: start firefox browser and WireShark,
record port 1935 TCP Traffic, select flash content and play.
Afterwards I use the "Follow Tcp Stream Option" in WireShark to extract all incomming traffic to a binary file.
I have no problems to decode rtmp chunks etc.

But many packets in the stream contain additional 0xC5 Bytes that corrupt my decoder.
They come in accidental order and count.
Using WinDump results the same way.
It seems to be a designed disturbance...

I made a look in RTMPdump source, but I couldn't find any prevention against this problem, except destroying packets with wrong length.

Example:

the flash player at

www.tagesschau.de

http://www.tagesschau.de/multimedia/sendung/ts23850.html

I hope, anyone has an idea.
It's really NOT urgent, just a hobby

Regards, danix99