[流媒体]按照MMS协议和MS Media Server交互
下载实时交通录像的包分析
---实例解析MMS流媒体协议，下载LiveMediaVideo
编写者 | 日期 | 关键词 |
郑昀@ultrapower | 2005-10-17 | mms streaming protocol ethereal 协议分析 流媒体 |
通过mms://220.194.63.17/cebeijing8，我们可以看到交通部门设置在北京西直门上的摄像头的实时录像，从而了解西直门的交通状况。
但是，要是想下载这个流媒体到本地的话，我试验了asfr+、ASF Recorder以及StreamBox vcr，均无法下载。又找了一个mimms-0.0.9的linux版本，也就是以前的mmsclient，将其依赖于Linux的某些函数库换成Windows版本的对应包，编译之后，可以下载mms://220.194.63.17/cebeijing8的数据，但是用WindowsMediaPlayer9播放的时候，却报告错误“无法播放，因为此文件已损坏”。
只有SDP2.0(Streaming Download Project)可以正常下载并播放它。
为了改造mimms，我分析了SDP和流媒体服务器的来往包，看看我和他的实现到底存在哪些差异。如果你也开发流媒体下载应用，希望这个分析对你理解 “Microsoft Windows Media Services”协议有帮助。
下面是每一个数据包。我们对每一个“包头”和“包体”的每一个字节都做了尽可能详细的分析。
对了，编码格式是“Little Endian”，也就是0f 00 00 00的实际值是0x0f。
第一对包：client to server 告知Player版本号
：to server;Len=104 |
0030 01 00 00 00 ce fa 0b b0 58 00 ...a..........X. 0040 00 00 4d 4d 53 20 0b 00 00 00 00 00 00 00 00 00 ..MMS .......... 0050 00 00 00 00 00 00 09 00 00 00 01 00 03 00 f0 f0 ................ 0060 f0 f0 0b 00 04 00 1c 00 03 00 4e 00 53 00 50 00 ..........N.S.P. 0070 6c 00 61 00 79 00 65 00 72 00 2f 00 37 00 2e 00 l.a.y.e.r./.7... 0080 31 00 2e 00 30 00 2e 00 31 00 39 00 35 00 36 00 1...0...1.9.5.6. 0090 3b 00 20 00 00 00 00 00 00 00 00 00 00 00 ;. ...........
|
“包头”解释：
l 01 00 00 004l ce fa 0b b0BOOB FACE4l 58 00 00 00(4d 4d 53 20)4l 4d 4d 53 20MMS ASCII4l 0b 00 00 00Length until end of packet in 8 byte boundary lengthsIncluding own data field4l 00 00 00 00Sequence number4l 00 00 00 00 00 00 00 008Double precision time stamp (see notes) used for network timingl 09 00 00 00Length until end of packet in 8 byte boundary lengths. Including own data field4l “01 00 03 00”, Comm 2 bytes | Dir 2 bytes01 00Command03 00Direction0x034
Comm 2 bytes | Dir 2 bytesBody
“包体”解释：
l f0 f0 f0 f0MMS1l 0b 00 04 00l 1c 00 03 00l 4e 00 53 00 50 00 6c 00 61 00 79 00 65 00 72 00 2f 00 37 00 2e 00 31 00 2e 00 30 00 2e 00 31 00 39 00 35 00 36 00 3b 00 20 00NSPlayer/7.1.0.1956; ASCIINSPlayerMMS15Upgrade Your Player
NSPlayermimms9.0.0.2800”。l 00 00 00 00 00 00 00 00 00 00
NSPlayer/; {128 GUID}; Host: IP NSPlayer/9.0.0.2800; {f5cec3a0-3e2c-11da-b2a2-00055d1a21bd}; Host: 220.194.63.17
但是，抓SDP2.0得到的包有点不一样。
第一对包：server to client 告知服务器版本号以及加密协议
2：to client;Len=144 |
0030 01 00 00 00 ce fa 0b b0 80 00 ..p............. 0040 00 00 4d 4d 53 20 10 00 00 00 00 00 00 00 73 00 ..MMS ........s. 0050 70 00 3a 00 2f 00 0e 00 00 00 01 00 04 00 00 00 p.:./........... 0060 00 00 f0 f0 f0 f0 0b 00 04 00 1c 00 03 00 00 00 ................ 0070 00 00 00 00 f0 3f 01 00 00 00 01 00 00 00 00 80 .....?.......... 0080 00 00 80 96 98 00 0d 00 00 00 00 00 00 00 00 00 ................ 0090 00 00 05 00 00 00 39 00 2e 00 30 00 31 00 2e 00 ......9...0.1... 00a0 30 00 31 00 2e 00 33 00 38 00 31 00 34 00 00 00 0.1...3.8.1.4... 00b0 4e 00 54 00 4c 00 4d 00 00 00 00 00 00 00 00 00 N.T.L.M......... 00c0 00 00 00 00 00 00 ......
|
“包头”解释：
l 01 00 00 00 ce fa 0b b0BOOB FACE8l 80 00 00 00(4d 4d 53 20)4l 4d 4d 53 20MMS ASCII4l 10 00 00 00Length until end of packet in 8 byte boundary lengthsIncluding own data field4l 00 00 00 00Sequence number
4l 73 00 70 00 3a 00 2f 008Double precision time stamp (see notes) used for network timingl 0e 00 00 00Length until end of packet in 8 byte boundary lengths. Including own data field4l “01 00 04 00”, Comm 2 bytes | Dir 2 bytes01 00Command04 00Direction0x044
Comm 2 bytes | Dir 2 bytesBody
“包体”解释：
l f0 f0 f0 f0MMS14l 0b 00 04 004l 1c 00 03 004l 00 00 00 00 00 00 f0 3f8l 01 00 00 00 01 00 00 00 00 80 00 0012l 80 96 98 00“00 00 a0 00” 8l 39 00 2e 00 30 00 31 00 2e 00 30 00 31 00 2e 00 33 00 38 00 31 00 34 009.01.01.3814ASCII9.01.01.3814Media Serverl 4e 00 54 00 4c 00 4d 00“NTLM”ASCII代表服务器的加密类型，诸如BASIC, DIGEST或者NTLM。
这个包中，在服务器版本号之后，加密类型之前，也可能有以下两种数据：
l 5.1.0.0l http://www.theupdatesite.com/updateplayer.htmlURL让你的客户端Windows Media Player更新最新这两个数据不一定会有，但是服务器版本号必须要有。
第二对包：client to server 请求“the timing test data method”
第二回合之1：to server;Len=48 |
0030 01 00 00 00 ce fa 0b b0 20 00 .o.6.......... . 0040 00 00 4d 4d 53 20 04 00 00 00 01 00 00 00 00 00 ..MMS .......... 0050 00 00 00 00 00 00 02 00 00 00 18 00 03 00 f1 f0 ................ 0060 f0 f0 0b 00 04 00 ...... |
“包头”解释：
l 01 00 00 00 ce fa 0b b0BOOB FACE8l 略
l “18 00 03 00”, Comm 2 bytes | Dir 2 bytes18 00Command03 00Direction0x03418what timing tests to do, if any
18 00 03 00Body
“包体”解释：
l f1 f0 f0 f0the TCP timing method is required4l 0b 00 04 004第二对包：server to client 网络带宽和数据速率测试包
第二回合之2：to client;Len=512 0030 01 00 00 00 ce fa 0b b0 f0 01 .g.............. 0040 00 00 4d 4d 53 20 3e 00 00 00 01 00 00 00 73 00 ..MMS >.......s. 0050 70 00 3a 00 2f 00 3c 00 00 00 15 00 04 00 00 00 p.:./.<......... 0060 00 00 f1 f0 f0 f0 08 00 00 00 01 00 00 00 00 00 ................ 0070 01 00 d4 b9 42 f1 00 00 00 00 01 00 00 00 00 00 ....B........... 0080 00 00 00 00 00 00 2d eb 9b 2d d2 fa e6 1c 09 12 ......-..-...... 0090 b7 df ab 5e 07 71 a7 a0 a2 77 fe d1 ea db 9d 07 ...^.q...w...... 00a0 ce 15 9c 80 bc d4 ae af 29 56 0e 44 77 b9 a8 c3 ........)V.Dw... 00b0 c1 1c 4d 4f 80 00 6c fd 06 6e b1 a8 0b 2e e1 25 ..MO..l..n.....% 00c0 21 15 2a fc e0 8e be 0f ae c4 8d c0 fb a7 df 5b !.*............[ 00d0 ca 77 58 7b 88 14 14 de 7d 68 13 d7 f9 ea 1b a8 .wX{....}h...... 00e0 26 ea 3f 17 09 8f c9 26 01 0b 83 39 70 d3 e7 d0 &.?....&...9p... 00f0 6e e8 d5 75 76 e8 09 00 c1 91 2c 04 18 e1 6b a3 n..uv.....,...k. 0100 77 f3 1e 38 a0 39 fe 4a 7b e0 96 62 3d fa 33 e6 w..8.9.J{..b=.3. 0110 69 b3 89 90 06 71 eb 50 50 88 03 fb 2d b8 89 78 i....q.PP...-..x 0120 0b 7e 3f be fe 5f 7a da 88 de 9e 66 3e a6 a2 84 .~?.._z....f>... 0130 5f b9 6b 9a 5c 9b f2 eb ef 64 16 73 3b 6a ac a7 _.k./....d.s;j.. 0140 14 6f d2 20 17 5e 75 18 24 cd 49 22 69 c2 c9 b4 .o. .^u.$.I"i... 0150 50 25 76 32 ec 24 18 c9 9c bd 89 09 84 4a 28 c5 P%v2.$.......J(. 0160 d7 20 57 97 c7 ab 69 ee 89 7c e9 4c f3 ae 57 9d . W...i..|.L..W. 0170 c1 22 bf 45 83 38 f0 eb 81 94 f8 ff ad 3f d7 fe .".E.8.......?.. 181551210561840
“包头”解释：
l 01 00 00 00 ce fa 0b b0BOOB FACE8l 略
l “15 00 04 00”, Comm 2 bytes | Dir 2 bytes15 00Command04 00Direction0x044
“15 00 04 00Body
“包体”解释：
l 00 00 00 00l f1 f0 f0 f0l 08 00 00 008l 01 00 00 00l 00 00 01 00;
l d4 b9 42 f1IDIDUDPclientl “00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00”l 随机数据。。。。
