How to record (capture) with rtmpdump by pstranger

This is one of the “Tips and Tricks” written by pstranger. I found it very interesting and decided to re-post it here.

Original post can be found here.

How to record (capture) with rtmpdump.

For example I want to record (capture) live broadcast of tv:

http://rt.com/on-air/

I run:

tcpdump -ieth0 -nn -A | grep -e"rtmp" -e"connect" -e"play" > rt.txt

Sometime it’s useful to add -e"app" option in grep in spite of it can capture a lot of garbage.

I open this page, waiting broadcasting and 3-4 times reload page again to fill buffer of output file (rt.txt in this case).

I always capture packets in file (sometimes output on console may be wrong or not full).

Next I open rt.txt and looking for piece of text like this:

connect.?..........app...live..flashVer...LNX 10,1,82,76..swfUrl..'http://rt.com/s/swf/player5.4.
viral.swf..tcUrl...rtmp://fm.s5.visionip.tv/live..fpad....capabilities.@m........audioCodecs.@.........videoCodecs.@o.......
videoFunction.?.........pageUrl....http://rt.com/on-air/..objectEncoding...........
.....T93.../...........play.............RT_3

and build command in accordance with this manual:

http://rtmpdump.mplayerhq.hu/rtmpdump.1.html

You should be careful with dots in options (turn on your brain and use cut and try method) like in this example:
rtmp://fm.s5.visionip.tv should be rtmp://fms5.visionip.tv

Here is example of 60 sec record:

rtmpdump -r rtmp://fms5.visionip.tv/live
-a live
-y RT_3
-W http://rt.com/s/swf/player5.4.viral.swf
-p http://rt.com/on-air/
-f "LNX 10,1,82,76"
-o ~/russia_tooday.flv
-B 60

The simple command:

rtmpdump -r rtmp://fms5.visionip.tv/live
-y RT_3
-o ~/russia_tooday.flv
-B 60

also works but they recommend to use full syntax.

Blumberg TV

http://www.bloomberg.com/tv/

connect.?..........app...live..flashVer...LNX 10,1,82,76..swfUrl..Jhttp://cdn.
gotraffic.net/v/20110210_153738//flash/Bloomber.gMediaPlayer.swf..tcUrl..*rtmpt://cp87869.live.edgefcs.net:1935/live..fpad....capabilities.@m......
..audioCodecs.@.........video.Codecs.@o.......
videoFunction.?.........pageUrl...http://www.bloomberg.com/tv/..objectEncoding.@.........

play………….us_300@21006

rtmpdump -r rtmpt://cp87869.live.edgefcs.net:1935/live
-a live
-y us_300@21006
-W http://cdn.gotraffic.net/v/20110210_153738//flash/BloombergMediaPlayer.swf
-p http://www.bloomberg.com/tv/
-f "LNX 10,1,82,76"
-o ~/bloomberg.flv
-B 60
--live

Video on demand:

Deutsche Welle

http://www.dw-world.de/dw/0,,4756,00.html

Program Euromaxx (with Roxette):

connect.?..........app..
a4337/dwwod1/..flashVer...LNX 10,1,82,76..swfUrl..;http://mediacenter.dw-world.de/player/flash/media.player.swf..tcUrl..*rtmpt://tvone.fcod.llnwd.net/a433
7/dwwod1/..fpad....capabilities.@m........audioCodecs.@.........videoCodecs..@o.......
videoFunction.?.........pageUrl..Khttp://mediacenter.dw-world.de/english/video/#!/72620/euromaxx/Program=7555..object.Encoding.@.........
................closeStream.....................H.....P.....play............;mp4:dwtv_video/flv/eme/emagen090211-euromaxx01ep_sd_avc.mp4

rtmpdump -r rtmpt://tvone.fcod.llnwd.net/a4337/dwwod1/
-a a4337/dwwod1/
-y mp4:dwtv_video/flv/eme/emagen090211-euromaxx01ep_sd_avc.mp4
-W http://mediacenter.dw-world.de/player/flash/media.player.swf
-p rtmpt://tvone.fcod.llnwd.net/a4337/dwwod1/
-f "LNX 10,1,82,76"
-o ~/euromaxx.flv

P.S. Some servers do not talk on this language and it’s hard to get options for rtmpdump in such a way.

Thanks pstranger.

Let me just add that tcpdump and rtmpdump are not in the system by default and can be installed using

apt-get install --yes tcpdump rtmpdump

command as root. I will add here as well that tcpdump commands must be issued as root as well. Don’t forget to pass the correct interface to tcpdump.

Andy