This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wireshark filter for finding url of live stream video

0

I have an url: http://www.mayapur.tv/newTemples/index.php?stream=Chowpatty/@Chowpatty

If i open in the browser it shows the the streaming video. I cant get the url of the stream video from the http headers or the html code.

I there any way to find the address of the streamvideo comming using wireshark. I dont know how to check tcp things in wireshark

asked 11 Feb '14, 22:15

Santhosh's gravatar image

Santhosh
1111
accept rate: 0%


One Answer:

3

I there any way to find the address of the streamvideo comming using wireshark.

sure.

  • start Wireshark capture
  • load the video and let it play for 30 seconds
  • stop Wireshark capture
  • Load statistics: Statistics -> Conversations -> TCP [Tab]
  • sort the list of connections and find the connection with the longest duration or max. bytes transferred
  • get the destination ip address
  • filter for dns in wireshark and find the request that matches the IP address. Hint: this step will only work if the client has not cached the DNS response from an earlier request!
  • take that name and build a filter like this: frame contains mtvnyc.dyndns.tv
  • you will find some RTMP connections. Look for rtmp://mtvnyc.dyndns.tv/xxxxx in those frames to get the full URL

Done.

Regards
Kurt

answered 13 Feb '14, 15:05

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 13 Feb '14, 15:13

Hi, I just would like to say thank you very much to Kurt. I start to study video streams in the end of 2011 and since today I never saw an explanation about how we can get adress of a streamvideo using Wireshark. I'd learn some today, so thanks again regards Roberto Diaz

(26 Oct '14, 07:00) cenahum

you're welcome!

(26 Oct '14, 15:28) Kurt Knochner ♦

I'm getting frames but how do I find the entry point? These seem to be chunks of .mp4 but there must be some index or entry point url.

(15 Apr '15, 20:48) John Doyle