Parsing EarthCam

Downloading videos from EarthCam, OS: Ubuntu 16.04.1 LTS

Step 1:

Download Wireshark (https://www.wireshark.org/) (Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions.)

Step 2:

Navigate to EarthCam. (http://www.earthcam.com/) Now, choose the camera that you want to sniff the information from. Note: Make sure all other tabs are closed because it would be difficult to locate the data packet from the live stream if multiple tabs are opened.

We will choose Times Square for this example. (http://www.earthcam.com/usa/newyork/timessquare/?cam=tsrobo1)

Step 3:

Now, open WireShark on your computer and double click on the way you access your internet connection. This window on your right should appear after you double click your internet source.

Step 4:

Note: Make sure only the NYC camera tab is open on your browser. This is the step where we sniff the data source from EarthCam. Click on the blue button in the top left corner of WireShark to start sniffing. (Indicated by an orange box in the photo below). As soon as you click the blue button, refresh the NYC tab. Then once the page loads again, allow it to play for a while (3 secs) and hit pause. Repeat the play and pause three times. Now, go to WireShark and click on the “stop” button to its right to stop sniffing.

Click the blue button to start sniffing. Click on the button to right of the blue button to stop sniffing.

Step 5:

We have now (“hopefully”) sniffed the source of the video. Time to analyze the data which we have obtained. We are now looking for the RTMP protocol. This protocol is used for streaming audio, video and data over the Internet, between a Flash player and a server. To do that, type in “rtmpt” in the filter section of WireShark. Then manually scroll down and look for “Handshake” in the info section.

         Type in rtmpt

Located “Handshake”

Step 6:

So, till now we have obtained information about the packets which EarthCam obtains. In this step, we shall analyze those packets to identify the source of EarthCam! Right click on the field that says “Handshake” -> Follow -> TCP Stream. A dialogue box now opens with all sorts of information – an ASCII dump. (It should be very similar to the image below. Make sure Show and Save data is in ASCII format.)

Now in Find, search for “play”. Keep search till you can see links above play which are like the ones shown in the image below. Alternatively, one could also search for “tcUrl”.

The information shown in the image above is all we need to parse the camera data.

Step 7:

In this step, we will use the information obtained in Step 6 (Figure 8.) and display a live stream on VLC media player. Note: Make sure to have rtmpdump installed. Command: sudo apt-get install rtmpdump. Make sure to have vlc-nox installed. Command: sudo apt-get vlc-nox.

The command given below will display the live-stream directly on VLC media player. rtmpdump -r "rtmp://video3.earthcam.com:1935/fecnetwork" -a "fecnetwork" -f "LNX 23,0,0,162" -W "http://static.earthcamcdn.com/swf/streaming/stream_viewer_v3.swf?20170307170000" -p "http://www.earthcam.com/usa/newyork/timessquare/?cam=tsrobo1" -y "9974.flv" --quiet | vlc –

Figure 9: Live stream playing on VLC Media Player. Explanation (Figure 8): “rtmp://video3.earthcam.com:1935/fecnetwork”
This is the link with the RTMP protocol. “http://static.earthcamcdn.com/swf/streaming/stream_viewer_v3.swf?20170307170000” This is the link to the flash file. “http://www.earthcam.com/usa/newyork/timessquare/?cam=tsrobo1” This is the link to the Times Square page on EarthCam. Step 8: (Downloading video from EarthCam) To download the live stream. Type the following: rtmpdump -r "rtmp://video3.earthcam.com:1935/fecnetwork" -a "fecnetwork" -f "LNX 23,0,0,162" -W "http://static.earthcamcdn.com/swf/streaming/stream_viewer_v3.swf?20170307170000" -p "http://www.earthcam.com/usa/newyork/timessquare/?cam=tsrobo1" -y "9974.flv" -R -o - | ffmpeg -i pipe:0 -t 10 9974.avi This command uses ffmpeg to download a 10 second video from the given link. “-t 10” - specifies the time interval of the video, a different time (in seconds) can be used to download a longer video.