[rtmpdump] How to determine rtmpt URL?

[Howard Chu]

Adam Augustine wrote:
> I am trying to capture the live stream at
> http://radio.lds.org/eng/listen-now. I have used various tools
> (Wireshark mostly) and the only semi-useful URL I can find is
> rtmpt://fls3g1.services.att-idns.net/al1 , which seems to be missing
> the playpath portion (at least according to rtmpdump). I am using the
> 2.2a r330 version of rtmpdump.
>
> It is all running on port 80, so I don't think I can use rtmpsuck
> (which I have used semi-successfully in the past on the normal 1935
> port streams).
>
> I can't seem to figure out where to look for the complete stream URL.
> I see lots of very short lived (less than a second) TCP connections
> with single GETs and POSTs with crazy paths and variables which change
> from one TCP stream to the next.
>
> I tried hacking rtmpsrv.c to listen on port 80 and put
> fls3g1.services.att-idns.net into /etc/hosts with 127.0.0.1 to see if
> I could get it to show the connect information but it reports "ERROR:
> SHandShake: Unknown version 50" "ERROR: Handshake failed" and closes
> the connection.
>
> I tried something similar with rtmpsuck (changing all the 1935s to
> 80s, recompling), removed the /etc/hosts entry, added the iptables
> (changing it to port 80 as well) entry, but it reported the same
> Unknown version 50 error.
>
> Any hints or ideas?

rtmpt support is only present for the client side at the moment. More changes 
are still needed to get rtmpsrv/rtmpsuck to recognize rtmpt...

But since your URL is using plain rtmpt and not an encrypted session, 
Wireshark should show you all of the required parameters. Just track port 80 
to the specific host, and watch for packets that contain significant strings 
like "connect" and "play" - these will have the parameters you're looking for.