RTMPDump


RTMPDump is a free software project dedicated to developing a toolkit for RTMP streams. The package includes three programs, rtmpdump, rtmpsrv and rtmpsuck.
  • rtmpdump is used to connect to RTMP servers just like normal Flash Video player clients, and capture the stream from the network, and save it to a file. With it, commands may be constructed using connection and authentication information previously obtained from the RTMP server by rtmpsrv.
  • rtmpsrv is used to watch connections and streams
  • rtmpsuck can also be used to capture streams, but can be used to detect parameters to be used with rtmpdump.
It has been reviewed as "an excellent utility for recording streams broadcasting TV and video on demand" and has been used in academic research on video streaming rate selection and a developmental media framework. The utility has been noted for its small size and its ability to decrypt both RTMPE and RTMPS digital rights management technologies.
In a 2009 Digital Millennium Copyright Act Cease and Desist order issued against SourceForge, Adobe Systems Inc. asserted that rtmpdump "can be used" to infringe copyrights, without claiming actual use. As of 2009, SourceForge had removed the project files, providing the message "The project specified has been flagged as deleted". From November 2009 onwards, the project has been hosted as a Git repository at MPlayer's website, MplayerHQ.hu.

On-demand streams

In negotiating a connection, an RTMP client sends and receives a data stream containing multiple elements, as a single command line. An on-demand stream typically includes the following elements:

For a Limelight server

  • -r rtmp://
  • -a: authentication elements
  • * Typically in the format -
?as=&av=&te=&mp=&et=&fmta-token=
  • * : A path address. For example, a1414/e3
  • * : For example, as=adobe-hmac-sha256
  • * : For example, av=1
  • * : For example, te=connect
  • * : Typically, two or more comma-separated URL addresses, for alternative bitrate streams
  • * : Typically, a ten-character number
  • * : Typically, a 64-character authentication string
  • -y: playpath
  • * Typically, in the format mp3:/.mp3 or mp4:/.mp4
  • -o: Output filename
The foregoing are typically the only elements that are essential to a connection, if neither Tunnelling nor Encryption are in use by the server. Although other elements may be encountered in practice, they are normally non-essential.
Hence the following elements are typically sent by the client software application, as a single command line -
rtmpdump -r rtmp://xxxxxxxx.fcod.llnwd.net
-a path?as=data&av=data&te=data&mp=data&et=data&fmta-token=data
-y mp4:URL/filename.mp4 -o file_mp4.flv
The parts comprising the -a element must be incorporated in it in the order shown above, as the sequence in which its parts are received by the RTMP server is critical.
The authentication strings contain session information, so will change on each fresh connection made to the server, but the other elements will not usually vary from session to session.

For an Akamai server

The command line is typically as above, except that the -a element contains the following parts instead -
  • : Typically, a 62-character authentication string
  • aifp: For example, aifp=v001
  • : Typically, the URL address of the stream
Hence the following elements are typically sent by the client software application, as a single command line -
program.exe -r rtmp://xxxxxxx.edgefcs.net
-a ondemand?auth=data&aifp=data&slist=data
-y mp3:URL/filename -o file_mp3.flv
The parts comprising the -a element must be incorporated in it in the order shown above, as the sequence in which its parts are received by the RTMP server is critical.
The authentication string contains session information, so will change on each fresh connection made to the server. The other parts will not usually vary from session to session.
Note - The above describes the simplified form, whereby the stream is first saved to the user's hard disk, to be played back thereafter in a media player capable of playing an FLV encoded file, such as GOM Player. If it's desired, instead, to play the stream directly from the RTMP server, thus giving immediate playback, additional elements will be needed in the command line including -
-f: This specifies the version of the Flash plugin installed on the user's computer. For example, -f "WIN 9,0,260,0" would indicate the user has the Windows version of Flash Player 9, release 260.
-W: The capital W command. This is the URL address of the SWF player used to play the stream, as indicated by the web page from which the stream is derived. For example, path/9player.swf?revision=18269_21576.

Live streams

The command line for an Akamai server is typically as for an Akamai on-demand stream. But the -a element contains the following parts
  • : Typically, a 62-character authentication string
  • aifp: For example, aifp=v001
  • : Typically, the URL address of the stream, in the format ; or more than one URL if more than one bitrate is available
Note - If the string contains two or more alternative streams, the element specifies the one chosen by the user, as the identifier item.
Hence the following sequence is typically sent by the client software application, as a single command line -
rtmpdump.exe --live -r rtmp://xxxxxxx.live.edgefcs.net
-a live?auth=data&aifp=data&slist=data
--playpath ?auth=data&aifp=data&slist=data -o output.flv
All these items are mandatory, and must be included in the order shown above. The string following the ? in both the -a and --playpath elements will typically be identical. The identifier item will typically be a sub-set of the slist data, otherwise they too will be identical. The -o element can specify an output filename chosen by the user.
Specifying the complete is unnecessary, as that element is constructed in memory by the client application. Typically, in memory it takes the following form:
-y xxxxx_x_@xxxx?auth=&aifp=v001&slist=xxxxx_x_@xxxx,xxxxx_x_@xxxx