Spoofing RTMP urls

[anrelou]

Hey, guys. I am trying to get RTMPE streaming urls from Flash on a site.

I examined the source of the swf file (attached!) and realized that the mechanism is as this:
1. SWF fetches the XML .../xmls/tiesraide/pirmais_baltijas_kanals.xml

<player>
<media>
<type>live</type>
<mode>full</mode>
<image/>
<server>
<origin>195.13.206.152</origin>
<origin>195.13.216.8</origin>
</server>
<language code="lv">
<stream quality="hq">mp4:pirmais_baltijas_kanals_ru_hq.stream</stream>
<stream quality="lq">mp4:pirmais_baltijas_kanals_ru_lq.stream</stream>
</language>
</media>
<security>
<resource_id>c-pirmais_baltijas_kanals</resource_id>
<auth_token>
S0fgGLrKHh8lyUbOu7CE5IYG+dyKk122iNXtOxnPycWcClJKHxUKNKC+bs0bbWY+fA8ZnHwLBOB39U4bY3OP0ptnSbhvqoOWm+F/v8VMMjiGFRROxanClKa0Bg+2NQ6i
</auth_token>
</security>
</player>

2. Then it goes to the balancing server: 195.13.206.152:80/loadbalancer?stream=pirmais_baltijas_kanals_ru_hq. stream, which returns another XML

<server>
<status>1</status>
<edge>195.13.206.155</edge>
<client>109.229.197.168</client>
</server>

3. Judging by the code, SWF establishes connection to "rtmpe://195.13.206.151/live/"

[img=http://s29.postimg.org/f4js22our/Screen_Clip_1.jpg]

Although I couldn't find the exact URLs in Wireshark (you may see the log pic attached), the rtmpe link was confirmed when I took a dump Flash Player page and searched in HxD. So, at this moment I already have this rtmpe link, but the live stream is not downloaded still (neither with VLC, nor with

rtmpdump.exe -r "rtmpe://195.13.206.151/live/" -W "https://www.<site url>/static/m_player.swf" --live -o downl.mp4

).

Both ffmpeg and rtmpdump say:

Trying different position for server digest!
RTMP_ReadPacket, failed to read RTMP packet header

I'm concerned that the RTMPE url is so simple. What did I do wrongly?