SYNOPSIS
rtmpsuck [-z]DESCRIPTION
rtmpsuck is a transparent RTMP proxy. It listens on port 1935 for RTMP sessions, but you can also redirect other ports to it as needed. It first performs an RTMP handshake with the client, then waits for the client to send a connect request. It parses and prints the connect parameters, then makes an outbound connection to the real RTMP server. It performs an RTMP handshake with that server, forwards the connect request, and from that point on it just relays packets back and forth between the two endpoints.It also checks for a few packets that it treats specially: a play packet from the client will get parsed so that the playpath can be displayed. It also handles SWF Verification requests from the server, without forwarding them to the client.
Once the play command is processed, all subsequent audio/video data received from the server will be written to a file, as well as being delivered back to the client.
The point of all this, instead of just using a sniffer, is that since rtmpsuck has performed real handshakes with both the client and the server, it can negotiate whatever encryption keys are needed and so record the unencrypted data.