Wireshark
Wednesday, April 21st, 2010Technical difficulty 4 You should know what http means and how to play a flv file.
Wireshark is my new Toy. Let me tell you why.
Ever try to save a Youtube video?
Save a streamed song or lecture?
In Canada, both actions usually are protected as long as it is for private or personal use. Practically, saving flash embedded content is a pain.
Aside It is possible to examine the browser cache directory or install plugins to intercept the embedded content. If that works for you great.
That is where Wireshark comes in. It is a cross platform network protocol analyzer based on Ethereal.
What does that really mean? Well it lets you examine the traffic coming into your computer, including the embedded content.
First grab Wireshark here: http://www.wireshark.org/
Next, install it and fire it up.
The following are instructions for capturing video from Youtube:
- Start capture on network card.
- Navigate to youtube video page, wait for video to completely load into the cache.
- Stop caputure on the network card.
- In the ‘Filter:’, paste ‘frame.len == 1434′, this should match the length of the segments of the video as it was downloading.
- Right click on one of the segments and click on ‘Follow TCP Stream’.
- This will assemble the TCP stream of the video with the headers.
- Click on the ‘Save As’ and save locally.
- Open a editor, like textpad and strip all the headers out of the top of the file.
- Test it in a player like vlc.
Similar steps are required for flash files.
For more details see my Wireshark notes.

