G'day all, Just over a month ago, someone by the moniker "Pigeon" posted [1] some information about decoding RTMP streams from Brightcove.
[1] http://osflash.org/pipermail/osflash_osflash.org/2008-July/015612.html I've used some of the hints contained in that posting, as well as the reverse-engineered documentation on the http://osflash.org/ web site, to write my own RTMP parser in Perl. This decoder converts the output of tcpdump into an FLV video file. The script is available [2] for your perusal and use; I'm interested in feedback! [2] http://www.zap.org.au/software/utils/scripts/extract-rtmp-flv To use the script, you need to capture the video/audio stream using tcpdump. In particular: 1. Start the tcpdump capture, most likely as root: tcpdump -i eth0 -p -s 0 -w file.tcpdump -v tcp src port 1935 (You can also use something like "-s 2000" instead of "-s 0" if you are certain that incoming IP packets will not exceed 2000 bytes in size). 2. As an ordinary user, open the relevant video URL in your browser window and start playback. 3. Once the video finishes playing, quit the tcpdump program (using CRTL-C). 4. Convert file.tcpdump into ASCII, as an ordinary user: /usr/sbin/tcpdump -r file.tcpdump -s 0 -vvv -X \ > file.tcpdump-ascii If you modify the script (by setting the $debug_ascii_in variable to 0), you do not need to do this step. See further into this e-mail why I do so. 5. Run the decoder script, as an ordinary user: extract-rtmp-flv file.tcpdump-ascii file.flv 6. If all goes well, you should have a working FLV file! There are a number of limitations with this script that I have not bothered to solve: 1. The output of the script is quite verbose; most of it is useful (at least for me!) for debugging when things go wrong. You can play around with the "$debug" variables if you like. 2. I've made a number of assumptions about the RTMP stream, most of which are documented in the code. The major one is that I do not (at this stage) parse the payload contents of RTMP packets of type 0x16: I just dump them out as-is to the FLV file. 3. The code handles out-of-sequence IP packet retransmissions and reordering; however, some retransmissions (where the re-sent packet has a different data length) are NOT handled. These are thankfully fairly rare. 4. If you have missing packets in your captured RTMP stream, the output FLV file most likely will be invalid at that point. TCP/IP is _supposed_ to retransmit lost packets, but the Brightcove servers apparently do not always do so. Since packet loss seems fairly certain, I usually capture a given video four or five times, then insert the missing data "by hand" into one of the tcpdump streams. This is much easier to do if the tcpdump is in ASCII---hence step 4 above! Naturally, packet numbers between tcpdump files are NOT consistent---you need to search for actual data byte patterns. Good luck. If you choose to fix up your input, I'd suggest looking carefully at the debugging output of the script, particularly "Checking for missing packets in tcpdump". You should also run the script under the Perl debugger ("perl -d"), setting a breakpoint just after the missing-packets check. That way, you can always use something like 'dump_string($payload_data[11022],"")' to dump data in hexadecimal form. I have successfully used the extract-rtmp-flv script on a number of captured RTMP streams of my own. And I hope the script helps others! It is NOT particularly efficient or fast, as I was more interested in debugging the output... and my machine at home is relatively fast in any case. Yours truly, John Zaitseff -- John Zaitseff ,--_|\ The ZAP Group Phone: +61 2 9643 7737 / \ Sydney, Australia E-mail: [EMAIL PROTECTED] \_,--._* http://www.zap.org.au/ v _______________________________________________ osflash mailing list [email protected] http://osflash.org/mailman/listinfo/osflash_osflash.org
