by andreafabrizi

andreafabrizi /rtmpSnoop

rtmpSnoop lets you to grab the RTMP properties from live or dumped video streams.

132 Stars 35 Forks Last release: Not found 31 Commits 2 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

rtmpSnoop - The RTMP sniffer!

rtmpSnoop lets you to sniff RTMP streams from live TV, online channels and straming services and dump the RTMP properties in many formats. You can analyse both live and dumped streams.

You can take a look at the GitHub project page


  • Live sniffing from one ore more interfaces
  • Read dumped streams from PCAP files
  • Dump the RTMP properties in more formats (simple list, m3u entry or rtmpdump syntax)
  • Easy to use and cross platform!


rtmpSnoop works both on Windows and Unix.
To run it you need only python (at least 2.7 version) and the scapy module.

Linux Installation
* Debian/Ubuntu:

apt-get install python-scapy
  • RedHat/Centos:
    yum install scapy.noarch

    yum install python-argparse.noarch

Mac Installation

  • Download pcapy from http://corelabs.coresecurity.com/
  • Download dnet from http://libdnet.sourceforge.net/

Unzip and cd in to dnet file then

 CFLAGS='-arch i386 -arch x86_64' ./configure --prefix=/usr
 archargs='-arch i386 -arch x86_64' make
 sudo make install
 cd python
 sudo python setup.py install

Windows Installation
Follow this guide to install scapy module on windows: http://www.secdev.org/projects/scapy/doc/installation.html#windows

Get the code

git clone https://github.com/andreafabrizi/rtmpSnoop.git


The syntax is quite simple:

$python rtmpSnoop.py -h
usage: rtmpSnoop.py [-h] [-i DEVICE | -f PCAPFILE]
                    [--out-list | --out-m3u | --out-rtmpdump] [-p PORT]
                    [--one] [--quiet] [--debug]

rtmpSnoop lets you to grab the RTMP properties from live or dumped streams.

optional arguments: -h, --help show this help message and exit

Input: -i DEVICE Device to sniff on (Default: sniffs on all devices) -f PCAPFILE PCAP file to read from

Output format: --out-list Prints the RTMP data as list (Default) --out-m3u Prints the RTMP data as m3u entry --out-rtmpdump Prints the RTMP data in the rtmpdump format

Additional options: -p PORT RTMP port (Default: sniffs on all ports) --one Quit after the first stream found --quiet Doesn't print anything except the RTMP output --debug Enable DEBUG mode


Sniffing on all interfaces, without filters:

sudo python rtmpSnoop.py

Sniffing on eth0, and looking for RTMP streams on port 1935 only:

sudo python rtmpSnoop.py -i eth0 -p 1935

Reading streams from PCAP file:

python rtmpSnoop.py -f dump/tv.pcap

Output formats

Default list:

url: rtmp://
app: live
pageUrl: http://www.test.com/embedded/channel/1/500/380
swfUrl: http://www.test.eu/static/player.swf
tcUrl: rtmp://
playPath: channel?id=123
flashVer: LNX 11,7,700,203
extra: S:OK 

m3u entry: ```

EXTINF:0,1, Stream

rtmp:// app=live pageUrl=http://www.test.eu/embedded/channel/1/500/380 swfUrl=http://www.test.eu/static/player.swf tcUrl=rtmp:// playPath=channel?id=123 conn=S:OK live=1 ```

rtmpdump syntax:

rtmpdump -r 'rtmp://' -a 'live' -t 'rtmp://' 
-y 'channel?id=12345' -W 'http://www.test.eu/scripts/player.swf' -p 'http://www.test.eu/embedded/channel/1/500/380' 
-f 'LNX 11,7,700,203' -C S:OK  --live -o stream.flv


If you want to support this project, please consider donating: * PayPal: [email protected] * BTC: 1JHCGAMpKqUwBjcT3Kno9Wd5z16K6WKPqG

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.