@barnseyboy wrote:
ok i’ll work on doing that. i presume that captured traffic will be in binary daapd format and will be difficult for me to scrutinise and compare differences without having some daapd tool/app to inspect the data.
I have a tool that I use to do that… It’s in svn in the /tools directory, called decodeflow.c.
It’s not a very nice tool, but it works something like this:
get a dump of traffic you want to see. use tcpflow to slice it into flows:
tcpflow -r raw.cap
This will drop a bunch of tcp streams. The one you will be interested in is the one from 3689 (or whatever port you are using).
Run the decodeflow utility on the flow, and it should dump out a bunch of files, the ones you’ll be interested in are “decoded.0 – decoded.x”. They are the iTunes responses, parsed and output in a easy (for me) to read tree format.
The file has a hard-coded dep on /sw/bin/zcat (iTunes uses gzip content encoding). You can change that on line 478 to your path to zcat.
— Ron