This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wireshark filter for finding url of live stream video

I have an url: http://www.mayapur.tv/newTemples/index.php?stream=Chowpatty/@Chowpatty

If i open in the browser it shows the the streaming video. I cant get the url of the stream video from the http headers or the html code.

I there any way to find the address of the streamvideo comming using wireshark. I dont know how to check tcp things in wireshark

livecapturetcp

asked 11 Feb '14, 22:15

Santhosh
1●1●1●1
accept rate: 0%

One Answer:

I there any way to find the address of the streamvideo comming using wireshark.

sure.

start Wireshark capture
load the video and let it play for 30 seconds
stop Wireshark capture
Load statistics: Statistics -> Conversations -> TCP [Tab]
sort the list of connections and find the connection with the longest duration or max. bytes transferred
get the destination ip address
filter for dns in wireshark and find the request that matches the IP address. Hint: this step will only work if the client has not cached the DNS response from an earlier request!
take that name and build a filter like this: frame contains mtvnyc.dyndns.tv
you will find some RTMP connections. Look for rtmp://mtvnyc.dyndns.tv/xxxxx in those frames to get the full URL

Done.

Regards
Kurt

answered 13 Feb '14, 15:05

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 13 Feb '14, 15:13

Hi, I just would like to say thank you very much to Kurt. I start to study video streams in the end of 2011 and since today I never saw an explanation about how we can get adress of a streamvideo using Wireshark. I'd learn some today, so thanks again regards Roberto Diaz

(26 Oct '14, 07:00) cenahum

you're welcome!

(26 Oct '14, 15:28) Kurt Knochner ♦

I'm getting frames but how do I find the entry point? These seem to be chunks of .mp4 but there must be some index or entry point url.

(15 Apr '15, 20:48) John Doyle