[osflash] Parsing RTMP streams from brightcove

[Pigeon]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings all,

Some RTMP streams from brightcove - including many videos from
www.nuts.tv - use a strange variant of RTMP for which there
does not seem to be any package/code available capable of handling
it apart from Adobe's flash player.

I have been analysing such a stream and have successfully decoded
it. I am offering my results and code in case they are of use.

A big problem I encountered was that I did not know about
RTMP chunking. Long RTMP packets are broken up into chunks,
of default size 4096 bytes but it can be changed, with the
start of each new chunk delimited by a single-byte RTMP packet
header. There is no mention of this behaviour or this use of the
single-byte header on http://osflash.org/documentation/rtmp
and it took me a lot of messing about to figure out what was
going on and why I was finding spurious extra bytes in the
FLV data.

These RTMP streams are formatted something like this:

1) RTMP packet containing onMetaData header

2) Two seek packets, which seem to confuse players if
   left in the output so I strip them out
   
3) RTMP video and audio packets containing the initial
   keyframes, chunked at 4096 bytes
   
4) Sequence of RTMP packets type 0x16 containing FLV
   audio and video tags. The packets are chunked at
   4096 bytes at the RTMP level.

I have successfully parsed these streams using the following
procedure: (System - Ubuntu gutsy/hardy (upgraded half way 
through the experiment :-) )

1) Play stream in browser and capture the packets on port 1935 using
   tcpdump.
   
2) Extract the client data from the captured stream using tcpick.

3) Chop off the RTMP setup part of the captured stream, leaving the
   onMetaData tag followed by the FLV part of the stream.
   
4) Parse the stream using the C code linked below. Please excuse the
   messy code. It's still full of my experimental mucking about,
   in particular stuff which exists because I did not know about the
   4096-byte RTMP chunking for most of the time I was experimenting.
   I have only just got it to work at all and I haven't had time to
   tidy it up yet.
   
5) The output from the C code is a flv-format video file which can
   be played by ffplay or mplayer.
   
Please see the following files:

C code: http://pigeonsnest.co.uk/stuff/x/rtmp/px.c (13kB)

Raw client data from captured TCP stream: http://rapidshare.com/files/130528623/tcpick_192.168.1.191_68.142.87.204_1935.clnt.3.dat.html (4723kB)

Head-truncated data, input to C code: http://rapidshare.com/files/130529054/in.html (4641kB)

Output from C code, flv video file: http://rapidshare.com/files/130529375/out.html (4639kB)

Hope this lot is of use to someone :-)

- -- 
Pigeon

Be kind to pigeons        - -        Pigeon's Nest: http://pigeonsnest.co.uk/
Lucy Pinder Television    - -    http://www.lucy-pinder.tv/
GPG key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x21C61F7F
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIgAJ/UxADjyHGH38RAk4eAJ9M/bCX2qn/qc9FKWrBRE8d8cMjigCfcOAd
nAWf+aXTSh7JWMAT0GFrGbc=
=5eRO
-----END PGP SIGNATURE-----