MistAnalyserRTMP

MistAnalyserRTMP

This analyser is made to work with RTMP and E-RTMP captures. These are usually obtained through applications such as wireshark or tcpdump. Capture the side sending the data and save it as a file, pass that file to this analyser.

Usage

MistAnalyserRTMP [options] [filename]

Option	shorthand	Value	Default	Description
--debug	-g	1-10	Set at compilation, 3 in most cases	Sets the debug level at which messages are printed
--detail	-D	0-10	2	Sets the detail level for analyses
--help	-h	Binary	false	If set, display usage and version information then exit
--reconstruct	-R	string		Reconstruct a FLV file from an RTMP capture
--timeout	-T	Numeral		Time in Seconds to run the analyses task
--validate	-V	Binary	false	If set activate validation mode for load testing
--version	-v	Binary	false	If set display the library and application version, then exit

Analysing an RTMP capture

In order to analyse the RTMP capture correctly you will need to provide the analyser the raw data of one side of the connection. This is easiest done by applications such as wireshark, tcpflow or tcpdump. Examples on how to use these capture applications will be given at the bottom of the page.

By default The analyser returns the messaging that happened during the capture. This usually means the handshake and AMF data. This is often already enough to judge what might be the problem if an RTMp stream is rejected by MistServer when ingesting, or by the other side when pushing.

Higher detail levels will show more such as detail level 3 adding chunk data and 4 chunk information. At 10 you get the full chunk data which might be a bit too much.

Sample output

Received AFM0 command message:
DDVTech Container returned
  String  connect
  Number  1
  Object
    String app live
    String type nonprivate
    String flashVer FMLE/3.0 (compatible; MistServer)
    String tcUrl rtmp://localhost/live
    Number capsEx 15
    Strict Array fourCcList
      String arrVal av01
      String arrVal avc1
      String arrVal hvc1
      String arrVal vp08
      String arrVal vp09
      String arrVal ac-3
      String arrVal ec-3
      String arrVal Opus
      String arrVal .mp3
      String arrVal fLaC
      String arrVal mp4a
    Object audioFourCcInfoMap
      Number ac-3 7
      Number ec-3 7
      Number Opus 7
      Number .mp3 7
      Number fLaC 7
      Number mp4a 7
    Object videoFourCcInfoMap
      Number av01 7
      Number avc1 7
      Number hvc1 7
      Number vp08 7
      Number vp09 7

CTRL: Set chunk size: 65536
Received AFM0 command message:
DDVTech Container returned
  String  releaseStream
  Number  2
  Null
  String  live%2bertmp

Received AFM0 command message:
DDVTech Container returned
  String  FCPublish
  Number  3
  Null
  String  live%2bertmp

Received AFM0 command message:
DDVTech Container returned
  String  createStream
  Number  4
  Null

Received AFM0 command message:
DDVTech Container returned
  String  publish
  Number  5
  Null
  String  live%2bertmp
  String  live

CTRL: Acknowledgement: 3670
CTRL: Window size: 2500000
Received AFM0 data message (metadata):
DDVTech Container returned
  String  @setDataFrame
  String  onMetaData
  ECMA Array
    Bool hasVideo 1
    Number videocodecid 7
    Number width 1280
    Number height 720
    Number videoframerate 50
    Number videodatarate 2008.9
    Bool hasAudio 1
    Number audiodelay 0
    Number audiochannels 2
    Number audiosamplerate 48000
    Number audiosamplesize 32
    Number audiodatarate 3000

Reconstructing an RTMP capture to an FLV file

RTMP and FLV are very similar formats, but only FLV is readily playable by most applications. To make it easier to look at the contents of an RTMP stream the Analyser supports converting it to an FLV file that is equivalent to the data in the RTMP stream in every way. This file can then be played, converted, or further processed any way you please.

Reconstructing example:

MistAnalyserRTMP capture.raw -R example.flv

Capture applications

Wireshark needs a graphical interface in order to work, which can mean it's not always an option. tcpflow and tcpdump can be used from commandline, which makes them great options to run on servers. tcpflow however automatically filters by connection and could be the better tool to use.

Wireshark

The recommended way to capture RTMP with wireshark is to capture the used TCP port using the correct network interface. Typically RTMP will be on port 1935 however you might be using a non-standard port in the RTMP url, in that case adjust the port as needed. When selecting the network interface you should be using the interface that will be used to send/receive RTMP packets, though depending on the OS you could use the any interface as well.

This will then start capturing packets. Generally it is recommended to stop capturing packets once you're ready to save the connection, however you could leave things running. Do note that if the RTMP connection is ongoing it will mean your capture can abruptly end.

In order to use this you will need to follow the TCP stream of the RTMP connection.

Then save one side of the connection.

tcpflow

tcpflow can capture RTMP by selecting the interface (as shown in ip a) and adding the specific port to listen on.

tcpflow  -i eth0 port 1935

You will receive both sides of the connection as separate files named host1-host2 these are immediately usable by the analyser.

tcpdump

tcpdump works similar to tcpflow, however it captures both sides into one file. You will still need to strip to one side of the connection. Wireshark might be easier to do this as you have an interface for this. Generally if tcpflow is available we would recommend using tcpflow as it'll filter by connection by default.

tcpdump -i enp6s0 tcp port 1935 -w rtmpcapture.pcap