[rtmpdump] How to determine rtmpt URL?

[Adam Augustine]

On Thu, Mar 11, 2010 at 8:59 PM, compn <tempn at twmi.rr.com> wrote:
> On Thu, 11 Mar 2010 19:07:51 -0800, Howard Chu wrote:
>>Adam Augustine wrote:
>>> Any hints or ideas?
>>
>>rtmpt support is only present for the client side at the moment. More changes
>>are still needed to get rtmpsrv/rtmpsuck to recognize rtmpt...
>>
>>But since your URL is using plain rtmpt and not an encrypted session,
>>Wireshark should show you all of the required parameters. Just track port 80
>>to the specific host, and watch for packets that contain significant strings
>>like "connect" and "play" - these will have the parameters you're looking for.
>
> heres what i sniffed, altho i am kinda noob at putting together a
> command line:
>
> Playing and resetting 9874_9200_01
> app al1
> flashVer WIN 10,0,42,34
> swfUrl http://radio.lds.org/mc_files/flash/theMormonChannelPlayer.swf
> tcUrl rtmpt://fls3g1.services.att-idns.net/al1
> pageUrl http://radio.lds.org/eng/listen-now
>

Thanks! The help from Howard and compn allowed me to recognize the
individual fields I needed. I didn't make the (now obvious in
retrospect) connection between the "Playing and resetting" values and
the --playpath value.

So for posterity's sake I am documenting the process I should have
followed. Would there be interest in my documenting in a format more
suited for inclusion in the standard distribution?

Anyway, with the help, I was able to sift through the packets and find
the packet that contained the "connect" string, which looked like:

$p.W._........./............b........connect.?..........app...al1..flashVer..
WIN 10,0,45,2..swfUrl..>http://radio.lds.org/mc_files/flash/theMormonChannelPlayer.s.wf..tcUrl..(rtmpt://fls3g1.services.att-idns.net/al1..fpad....capabilities.@.........audioCodecs.@.........videoCodecs.@o........
videoFunction.?.........pageUrl..#http://radio.lds.org/eng/listen-now..objectEncoding.@..........

This gave the --app value (al1), the --flashVer value (WIN
10,0,42,34), the --swfUrl value
(http://radio.lds.org/mc_files/flash/theMormonChannelPlayer.swf), the
--tcUrl value (rtmpt://fls3g1.services.att-idns.net/al1), and the
--pageUrl value (http://radio.lds.org/eng/listen-now).

All I appeared to be missing was the playpath value. I searched for
the "play" string in the packet capture I had and the first packet
after the one with the "connect" string looked like (as compn had
posted) this:

......!.........play.............9874_9200_01...........

So "9874_9200_01" was the only other thing in that packet so I figured
I would try as the missing parameter. It worked, of course. And that
is when I realized compn had already given me everything I needed.
Still, it was good to learn the process so I can decode future
streams.

Anyway, I started out with a command line that had almost every option
filled out. I then tried to pare it down to the minimum required. Here
is what I ended up with:

./rtmpdump -r rtmpt://fls3g1.services.att-idns.net/al1/9874_9200_01 -a
al1 --pageUrl http://radio.lds.org/eng/listen-now --swfUrl
http://radio.lds.org/mc_files/flash/theMormonChannelPlayer.swf  --live
-o radio.lds.org.flv

I was unable to get it shorter than that (though I think the
completeness of the URL in the -r option should obviate the need for
the -a option, from what I understood from the man page), but it works
and I am happy.

Thanks for all the help. And thanks Howard and company for writing
such a useful utility.

Adam Augustine