OTA program (URLSnooper and rtmpdump)

[linuxman]

Hello,

I'm a little new to this, so forgive me.  I'd like to capture a program (a Net replay of what was on a local ATSC station) and enjoy it later.  One copy, like a book (legal in US).  I'm reading quite a bit on this topic but I need help understanding it (also, it is only on the network's website for a limited time).

When I right-click on the media (while playing) I learn that Flash player is playing, but of course there is no option to save the program.  When I click outside the playing window (but inside the browser window) I have the option to save a couple of commercials that came before the program, and I think I saved them correctly (they don't have the protection the program does).  So it is probably flash.  But using a sniffer and whatnot, the .flv file I got (for what I thought was the actual program) is only about 20K.  Clearly this is going to be harder than I thought.

I think the media file is NOT in my browser cache (just like when I paid to see a web page with my credit score on it -- I could print, etc. and save the page to my hard drive, but the credit score number was not there.  There must be a "no cache" option, and it's probably being used).  So putting the drive in another machine and using an undelete program will probably not find it.

URLSnooper gave me some results, and I'm afraid I need your help to interpret them to give them to rtmpdump.

Player -- I thought that was the flash player on my local hard drive.  But maybe it is the "***VideoApp.swf" on the XXX network's web site (ABC, FOX, NBC, CBS, whatever).  Or maybe "mediaplayer.swf" at a third party site.  Which is it?

Authentication -- I am lost.  The only authentication I know about is HTTPS, WEP and WPA (never used PGP or GPG).  What do they mean?  Do I look for a specific cookie or file with a certain extension to find out more?  Will this even be an issue?

Port -- I assume it played on port 80, for normal http traffic.  Although there are lists of common ports out there, and flash could have a different default port.

File name -- This is going to be hard.  Really hard.  I thought I knew it, and downloaded the .swf file, but it was only about 20K.  For a 42-minute program, this was clearly the wrong file.

Also, the sniffed items show many "GET" protocol things (html, xml, jpeg, gif and more).  Do any of these fetch authentication tokens, etc. that I need for it to work?

And what is "playpath"?  The path to the player (XXXplayer or mediaplayer.swf)?

I am running Firefox 3.5.2 on XP 64-bit.  I also have 64-bit Mandriva (2008.1, 2009.1).  I am not afraid of the command line AT ALL, but I suspect Windows tools will be better developed and easier to use for this.

Any help is greatly appreciated.

[dc12]

If you can speak German, there are good video tutorials at sempervideo.de
http://www.sempervideo.de/?p=3751   ZDF Mediathek Stream speichern (Folge 2)
http://www.sempervideo.de/?p=3807   RTMPDUMP: Southpark rippen

An Example Video to dump.
http://www.zdf.de/ZD...acko-in-Los-Angeles/

Here are the Parameters
-o             the filename                                     -o "c:\zdf.mp4"
-r              the URL                                           -r rtmp://ondemand.flash.zdf.newmedia.nacamar.net/zdf/mp4:zdf/data/quicktime/zdf/09/07/090703_neubauer_h19_vh.mp4
--host        the hostname                                   --host ondemand.flash.zdf.newmedia.nacamar.net
--port        the Port Number (default 1935)            --port 1935
--protocol   Protokoll rtmp oder rtmpe (encrypted)   --protocol rtmp
--playpath   the playpath behind the first path        --playpath mp4:zdf/data/quicktime/zdf/09/07/090703_neubauer_h19_vh.mp4
--swfUrl      the swf-player                                  --swfUrl http://www.zdf.de/ZD...hek/flash/player.swf
--tcUrl        the first part of the rtmp-URL              --tcUrl rtmp://ondemand.flash.zdf.newmedia.nacamar.net/zdf
--pageUrl    URL from PopUp                                 --pageUrl http://www.zdf.de/ZD...nt/9602?inPopup=true
--app         the first path behind the host-url          --app zdf
--flashVer   which version of Flash ?                      --flashVer "WIN 10,0,22,87"
( --auth     don't know the use of Authentication )

There are several ways to use the parameters to dump the video
the complete with 10 parameters -o --host --port --protocol -playpath --swfUrl --tcUrl --pageUrl --app --flashVer
rtmpdump.exe -o "c:\zdf.mp4" --host ondemand.flash.zdf.newmedia.nacamar.net --port 1935 --protocol rtmp --playpath mp4:zdf/data/quicktime/zdf/09/07/090703_neubauer_h19_vh.mp4 --swfUrl http://www.zdf.de/ZD...hek/flash/player.swf --tcUrl rtmp://ondemand.flash.zdf.newmedia.nacamar.net/zdf --pageUrl http://www.zdf.de/ZD...nt/9602?inPopup=true --app zdf --flashVer "WIN 10,0,22,87"

or shorter with just 4 parameters -o --host --playpath --app
rtmpdump.exe -o "c:\zdf.mp4" --host ondemand.flash.zdf.newmedia.nacamar.net --playpath mp4:zdf/data/quicktime/zdf/09/07/090703_neubauer_h19_vh.mp4 --app zdf

with 3 parameters -o -r und --playpath
rtmpdump.exe -o "c:\zdf.mp4" -r rtmp://ondemand.flash.zdf.newmedia.nacamar.net/zdf/mp4:zdf/data/quicktime/zdf/09/07/090703_neubauer_h19_vh.mp4 --playpath mp4:zdf/data/quicktime/zdf/09/07/090703_neubauer_h19_vh.mp4

hope this helps

[linuxman]

Thanks, I'll look into that if time permits (don't read German though).

I *_think_* I've got it now.  Someone at another forum posted a link to some guides and software at other audio/video sites (this one and this one, rtmpdump gets good mention on both).

Another product may have already captured the content for me*, but in doing so, I learned some interesting stuff.  The "encryption" is another layer of protection Adobe has added (if you find an RTMPE URL instead of an RTMP one).  This may be the same as "authentication" that URLSnooper's help screen talks about.  Anyway, it does not appear to be in use in this case.

The name of the actual media file (on the content provider's hard drive) may be inside .smil files or other places in the interaction (packets, GET requests) with your computer.  The other product found the name and I wrote it down.  Some of the characters are missing (.../.../subdirectory/name-of-flashfile.flv) but I have enough to do a search in URLSnooper.

Still not sure what RTMPApp is, maybe the software that serves the flash to me (rtmp://123.123.123.123:443/...vhost=*******.edgefcs.net).  That last part may be the "host" that rtmpdump wants (edgefcs.net).  The port is 443.

I will likely try URLSnooper soon.

I think both sites mentioned earlier (this one and this one) mention WMCapture as good "framegrabber" software (off my video card's memory chips) but I don't know that that would be any better.  The original flash had a certain limited quality (and I'm playing it as large as I can in my browser window), and I can't "make up" picture details that weren't there, right?

*Does 205 megs sound right for a one-hour US network TV program?  Why do I have two files, one 201 megs and one 205 megs?

I'll let you know....