Can't capture RTMP video from five.tv with Wireshark

johnaaronrose · #1 11-04-2010, 10:51 AM

Peter Thomas,

I've tried to use Wireshark to capture a video on:

Code:

http://www.five.tv/shows/eddie-stobart-trucks-trailers/episodes/episode-4-135

When I saw no rtmp packets, I did the following:
The first item to check: is the RTMP using the standard port 1935 in this capture? If not, tell WireShark how to decode it (see last step below).
The second item to check: turn on heuristics Edit → Preferences → Protocols → TCP → Try heuristic sub-dissectors first: FAILED.
If all else fails, brute force: right-click one of the packets → Decode As... → RTMP

I've saved the third step's results but can't send it as it's 11MB. There are handshakes but I don't see the first (or second part) of the video's URL. Should I use the Destination IP?
I'm not able to see the second part of the URL?

Any ideas?

John