Wireshark · Wireshark-users: Re: [Wireshark-users] Can't get static URL for this radio station

[Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>]

On Tue, Mar 03, 2009 at 08:59:18AM -0500, Richard Branham wrote:

> The "listen live" link for this radio station is on 
> http://www.wgst.com/pages/listenlive.html I can use another program 
> (not Wireshark) to get the mms url but it appears to have an 
> authorization field which changes periodically.  I'd like to be able 
> to use a static link rather than having to use a sniffer every time I 
> turn on the online radio.

Are the HTTP headers below what you're looking for?  I did a packet 
search (CTRL-F) for "MMS" (of type string) and came across a packet with 
the "Content-Type: application/x-mms-framed" header, then went to the 
Analyze menu and did a Follow TCP Stream.

GET 
/D/1845/19883/v0001/reflector:11227?auth=caEcAbNaGdXbYd8cZaHaqascVb8aBcBbNdQ-bjRCZd-4q-RM6V2_aolGApn1FAtjDtDq&aifp=1234&CPROG=SIMULCAST&MARKET=ATLANTA-GA&MNM=1&NG_FORMAT=newstalk&NG_ID=wgst640am&OR_NEWSFORMAT=newstalk&REQUESTOR=WGST-AM&SERVER_NAME=www640wgstcom&SITE_ID=1153&STATION_ID=WGST-AM 
HTTP/1.0
Accept: */*
Host: a1845.l1988311227.c19883.g.lm.akamaistream.net
User-Agent: NSPlayer/4.0
Supported: com.microsoft.wm.sswitch
Pragma: no-cache
Pragma: xClientGUID={fbab3bff-a8d6-b38a-f752-37fd2447bea0}
Pragma: request-context=2
Pragma: xPlayStrm=1
Pragma: rate=1.000
Pragma: stream-time=0
Pragma: stream-offset=4294967295:4294967295
Pragma: packet-num=4294967295
Pragma: max-duration=0
Pragma: AccelBW=2147483647, AccelDuration=2147483647
Pragma: stream-switch-count=2
Pragma: stream-switch-entry=ffff:1:0 ffff:2:0