when i run url snooper, it does comes up with "rtmp://cp269617.edgefcs.net/ondemand"
the rest of the text does not seem to be part of that packet.. if you look at the raw packets you will see intervening text.. if you add ".mp4" in the "Also Find" box you will also get:
You have given me a good idea though -- perhaps an option to tell URL Snooper that WHENEVER it finds a multimedia url, it should automatically record the next 2-3 packets in the result window for human analysis. I think this would be extremely useful because it's often the case that a streaming url is found and you want to see what the communication immediately following it was. Sometimes it is a snippet of a filename, etc. that is useful.