3
votes

How can Wireshark be used to extract, in real-time (i.e., continuously, not from a capture file) a string such as:

StreamTitle='The Rolling Stones - Black Box [Disc 3] (1970) - Bitch';

from a network audio stream (such as http://50.7.76.250:8757/stream), and append this string to a file?

What I'm trying to do is make a real-time playlist from this network audio stream for posting on a website.

My first attempt to do what I wanted was to compile the source code for VLC Media Player on CentOS 6 so I could simply write, based on their New Title= debug statement, the corresponding string (e.g., 'Van Morrison - Born To Sing: No Plan B (2012) - Retreat and View') to a file. Unfortunately I could not get the source code to compile.

After failing to get VLC Media Player to compile under CentOS I switched to using Wireshark to inspect the TCP stream. Using Find, I can locate the StreamTitle= info from captured packets, but I can't figure out how to extract- & save-it on a real-time, continual basis (e.g., 24x7).

ETA: I know Perl and C if I have to write code to do this.

UPDATE: I ended up learning enough Lua to script VLC and get what I needed:

function get_meta_now_playing()
  local inpt = vlc.object.input()
  if inpt == nil then
    return nil
  end
  local item = vlc.item or vlc.input.item()
  if not item then
    return nil
  else
    local metas = item:metas();
    local nwp   = metas["now_playing"]
    if nwp then
      return nwp
    else
      return nil
    end
  end
end
1
Upvote for changing default usernames and passwordsAnthony Russell

1 Answers

1
votes

What you're looking at is a stream with SHOUTcast-style (commonly referred to as ICY) metadata muxed in. As far as I know, there are no Wireshark filters for demuxing this. However, the problem is even simpler than that.

The metadata is inserted at regular intervals. You don't even need VLC to strip it out. If you look at the response headers, you will see one called Icy-MetaInt. This is the interval, in bytes, of the metadata chunks. The first byte in the metadata chunk is the length of the metadata block divided by 16. The metadata block is then padded by null bytes.

For example, suppose the meta interval is 8192 bytes...

[8192 bytes of audio][1 byte meta length][meta block][8192 bytes of audio][etc...]

Just read the first byte after the audio, multiply by 16, and then read that many bytes from the stream for your metadata block. Chop off the null bytes at the end of it, and you have your data.

Even simpler, StreamRipper outputs the metadata on its STDERR stream. You could pipe that into a script.

See my answer here for more details: https://stackoverflow.com/a/4914538/362536