Use IPtables, RTMPSrv and RTMPDump to Save RTMP Streams

Using iptables and rtmpsrv, you can save the rtmp:// streams, especially the ones  that are well hidden. The rtmp stream is being called from the the .swf file.

You can use packet sniffers to sniff on the macromedia-fs port (1935), bu there is a more convinient and effective way to tackle this.

1. # iptables -t nat -A OUTPUT -p tcp --dport 1935 -j REDIRECT
2. $ rtmpsrv
3. Start playing the online video from a normal web browser.
4. The rtmpsrv command should spit out the rtmp:// URL for the video you are trying to download.
5. # iptables -t nat -D OUTPUT -p tcp --dport 1935 -j REDIRECT
6. $ rtmpdump $url_from_step_4

First, you redirect all the macromedia-fs traffic to your localhost. Then, you start the rtmpsrv to listen on 1935. When you start playing the RTMP video, the request from your browser to the server hosting the video, will get redirected to your localhost where rtmpsrv is listening. What rtmpsrv exactly does, is that it dumps the URL generated from from you client (the swf file) to the media-streaming server. This URL is the most precious, you just take it and as it is and pass it to the rtmpdump tool. The rtmpdump will start dumping the stream to your local disk, amazing!.

In step 5, you just remove the redirection rule.

This howto is meant to be used legally.