tv.vnutri.info: Download or capture RTMFP stream (p2p video stream from Flash Player)

[sam4037]

Excellent tutorial! Thanks!

How did you know to include stream.php in the filter as well as search for http.request.uri? Can you perhaps explain what makes you decide what filter to use? Normally I would go with the rtmpt filter.

Again, thanks!

Just started using Wireshark and it looks pretty damn powerful compared to other sniffers.

How about this channel, can you sniff that with Wireshark as well? http://www.youtube.com/user/UltraHindi All the "Bollywood Movies", think they are also available internationally so should not be a problem working with. Would be excellent to see some Wireshark tutorial on those videos/channel.

Again, thanks so much KSV!

[sam4037]

Originally Posted by clueless

But going the KSV way (wireshark+rtmpdump) gives you a better understanding of what actually is going on.

This is exactly why I hope to hear from KSV and/or people that use wirehsark and rtmpdump. Thanks!

[KSV]

@chap

I looked through the rtmpdump code. Actually rtmpdump is using the normal rtmp protocol to download video not rtmfp. you can simply replace rtmfp with rtmp. rtmfp is intended for load distribution using end user's upload capacity and it's UDP based unlike rtmp which is TCP based.

following are the relevant code parts:

#define RTMP_FEATURE_HTTP	0x01
#define RTMP_FEATURE_ENC	0x02
#define RTMP_FEATURE_SSL	0x04
#define RTMP_FEATURE_MFP	0x08	/* not yet supported */
#define RTMP_FEATURE_WRITE	0x10	/* publish, not play */
#define RTMP_FEATURE_HTTP2	0x20	/* server-side rtmpt */

#define RTMP_PROTOCOL_UNDEFINED	-1
#define RTMP_PROTOCOL_RTMP      0
#define RTMP_PROTOCOL_RTMPE     RTMP_FEATURE_ENC
#define RTMP_PROTOCOL_RTMPT     RTMP_FEATURE_HTTP
#define RTMP_PROTOCOL_RTMPS     RTMP_FEATURE_SSL
#define RTMP_PROTOCOL_RTMPTE    (RTMP_FEATURE_HTTP|RTMP_FEATURE_ENC)
#define RTMP_PROTOCOL_RTMPTS    (RTMP_FEATURE_HTTP|RTMP_FEATURE_SSL)
#define RTMP_PROTOCOL_RTMFP     RTMP_FEATURE_MFP

const char RTMPProtocolStrings[][7] = {
  "RTMP",
  "RTMPT",
  "RTMPE",
  "RTMPTE",
  "RTMPS",
  "RTMPTS",
  "",
  "",
  "RTMFP"
};

const char RTMPProtocolStringsLower[][7] = {
  "rtmp",
  "rtmpt",
  "rtmpe",
  "rtmpte",
  "rtmps",
  "rtmpts",
  "",
  "",
  "rtmfp"
};

RTMP_Log(RTMP_LOGDEBUG, "Protocol : %s", RTMPProtocolStrings[protocol&7]);

above code shows that rtmpdump actually using normal rtmp protocol for rtmfp url's.

[chap]

Originally Posted by KSV

above code shows that rtmpdump actually using normal rtmp protocol for rtmfp url's.

Works too.

-r rtmp://85.17.30.74/multicast/54631211 -a multicast/54631211 -y stb --live -o Test.flv

Microsoft Windows XP [Версия 5.1.2600]
(С) Корпорация Майкрософт, 1985-2001.

C:\Documents and Settings\Администратор\Мои документы\STREAM\rtmpdump-2.3-window
s\rtmpdump-2.3>"C:\Documents and Settings\Администратор\Мои документы\STREAM\rtm
pdump-2.3-windows\rtmpdump-2.3\rtmpdump568.exe" -r rtmp://85.17.30.74/multicast/
54631211 -a multicast/54631211 -y stb --live -o Test.flv
RTMPDump v2.3 r568 (Compiled by KSV)
(c) 2010 Andrej Stepanchuk, Howard Chu, The Flvstreamer Team; license: GPL
Connecting ...
INFO: Connected...
ERROR: rtmp server sent error
Starting Live Stream
INFO: Metadata:
INFO:   author
INFO:   copyright
INFO:   description
INFO:   keywords
INFO:   rating
INFO:   title
INFO:   presetname            Custom
INFO:   creationdate          Sat May 07 15:39:41 2011
INFO:   videodevice           VideoMate H900 Video Capture
INFO:   framerate             24.00
INFO:   width                 468.00
INFO:   height                382.00
INFO:   videocodecid          VP62
INFO:   videodatarate         500.00
INFO:   videokeyframe_frequency5.00
INFO:   audiodevice           VideoMate H900 Audio Capture
INFO:   audiosamplerate       44100.00
INFO:   audiochannels         1.00
INFO:   audioinputvolume      75.00
INFO:   audiocodecid          .mp3
INFO:   audiodatarate         96.00
1590.726 kB / 20.45 sec

How to make rtmpsrv,rtmpsusk identify such flows? Or it is not possible.

[placebo]

Originally Posted by sam4037

How did you know to include stream.php in the filter as well as search for http.request.uri? Can you perhaps explain what makes you decide what filter to use? Normally I would go with the rtmpt filter.

Good question. From now on, normally i will go with a simple PHP filter, both in CooJah settings and in Wireshark. PHP server scripts seem to play a crucial role in (non-standard) streaming tasks as the history of a couple of recent SRF stream recording problems has shown. Maybe it's an idea to start with Coojah to get the broad picture. Then from examining the various tabs (captured url's) we'd focus on url's with common sense keywords ("php", "video", "stream", "play", ..). Finally those keywords can be entered as filter in Wireshark to examine the url in more detail ("Follow TCP Stream").



That involves quite some time and efforts .. so i'd follow this path of workflow only when my GetFLV fails to get some result.. which is rather rare these days.

@getflv
please could you look into it? chap would love to see GetFLV supporting this TV site!

[KSV]

Originally Posted by chap

How to make rtmpsrv,rtmpsusk identify such flows? Or it is not possible.

AFAIK not possible with current version of rtmpdump suite.

Originally Posted by sam4037

Can you perhaps explain what makes you decide what filter to use? Normally I would go with the rtmpt filter.

if your target site uses simple rtmp then rtmpt filter will be enough to get the required info. but if it uses rtmpe then you can use http or xml as filter to get the url. most (but not all) sites use xml for their playlist format. if you are unable to find info this way then you can redirect the traffic to rtmpsrv or rtmpsuck and it will automatically decrypt the parameters sent by client.

Originally Posted by sam4037

How about this channel, can you sniff that with Wireshark as well?

YouTube uses html for their playlist format. you can easily get the parameters with html filter but the main problem will be that YouTube switched to RTMPE 9 handshake few weeks ago which is not currently supported by rtmpdump.

Originally Posted by placebo

That involves quite some time and efforts .. s

everything has a learning curve. once you get used to it it will be really easy.

[moneymaker]

<link>rtmfp://94.242.221.205:2935/multicast_4hd swfUrl=http://clients.cdnet.tv/flashplayer/player2.swf token=Rd#n@k72JDh pageUrl=http://clients.cdnet.tv/ swfVfy=1 live=1 timeout=10</link>

I got this with wireshark from simple-tv.com

Originally Posted by KSV

above code shows that rtmpdump actually using normal rtmp protocol for rtmfp url's.

Can someone tell me how I can to play these stream in simpletvplayer or xbmc?

rtmpdump does not support rtmfp ?! But KSV posted that rtmpdump using the normal rtmp protocol for rtmfp url's.

thanks

[hasomaso]

hey KSV,

sorry i had to open the thread again.
how can i play the streams with vlc player from this site?

http://schoener-fernsehen.com/

I think the above method does not work anymore!
can you help me please


thx
hasomaso