[osflash] Parsing RTMP streams from brightcove
osflash at pigeonsnest.co.uk
Thu Jul 17 19:39:59 PDT 2008
-----BEGIN PGP SIGNED MESSAGE-----
Some RTMP streams from brightcove - including many videos from
www.nuts.tv - use a strange variant of RTMP for which there
does not seem to be any package/code available capable of handling
it apart from Adobe's flash player.
I have been analysing such a stream and have successfully decoded
it. I am offering my results and code in case they are of use.
A big problem I encountered was that I did not know about
RTMP chunking. Long RTMP packets are broken up into chunks,
of default size 4096 bytes but it can be changed, with the
start of each new chunk delimited by a single-byte RTMP packet
header. There is no mention of this behaviour or this use of the
single-byte header on http://osflash.org/documentation/rtmp
and it took me a lot of messing about to figure out what was
going on and why I was finding spurious extra bytes in the
These RTMP streams are formatted something like this:
1) RTMP packet containing onMetaData header
2) Two seek packets, which seem to confuse players if
left in the output so I strip them out
3) RTMP video and audio packets containing the initial
keyframes, chunked at 4096 bytes
4) Sequence of RTMP packets type 0x16 containing FLV
audio and video tags. The packets are chunked at
4096 bytes at the RTMP level.
I have successfully parsed these streams using the following
procedure: (System - Ubuntu gutsy/hardy (upgraded half way
through the experiment :-) )
1) Play stream in browser and capture the packets on port 1935 using
2) Extract the client data from the captured stream using tcpick.
3) Chop off the RTMP setup part of the captured stream, leaving the
onMetaData tag followed by the FLV part of the stream.
4) Parse the stream using the C code linked below. Please excuse the
messy code. It's still full of my experimental mucking about,
in particular stuff which exists because I did not know about the
4096-byte RTMP chunking for most of the time I was experimenting.
I have only just got it to work at all and I haven't had time to
tidy it up yet.
5) The output from the C code is a flv-format video file which can
be played by ffplay or mplayer.
Please see the following files:
C code: http://pigeonsnest.co.uk/stuff/x/rtmp/px.c (13kB)
Raw client data from captured TCP stream: http://rapidshare.com/files/130528623/tcpick_192.168.1.191_188.8.131.52_1935.clnt.3.dat.html (4723kB)
Head-truncated data, input to C code: http://rapidshare.com/files/130529054/in.html (4641kB)
Output from C code, flv video file: http://rapidshare.com/files/130529375/out.html (4639kB)
Hope this lot is of use to someone :-)
Be kind to pigeons - - Pigeon's Nest: http://pigeonsnest.co.uk/
Lucy Pinder Television - - http://www.lucy-pinder.tv/
GPG key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x21C61F7F
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the osflash