the web is full with different funny virus-full programs that promise you to download videos from different tube sites. I will present you a quite universal way of doing it on unix (linux) machines.

Requisites:

• tshark
• sed
• grep
• wget

probably you will find sed, grep and wget already installed on your system. For example on Ubuntu you can issue:

user>sudo apt-get install tshark

or on fedora/redhat

root> yum install tshark

If this does not work on your system, go to their website and download the sources.

Tshark provides a super-set of functionalities of that provided by tcpdump. Both tshark and tcpdump are so called network sniffer tools, with their help you can investigate what is happening on your local network. You can output the content of tcp/ip packets in different formats (ps, xml, text). You can select if you want just certain field of certain type of packets. The following command selects the http packets that have destination port 80:

sudo tshark -i eth0  -d tcp.port==80,http

this will contain too much from what we do not want, and will not provide what we want.

sudo tshark -i eth0  -d tcp.port==80,http -T fields -ehttp.host -e http.request.uri

the form above introduces two new flags, -T and -e. The -T specifies the output types. The type field requires field specifiers that are specified with the -e flags. So the form above selects the fields destination host and the uri. This form will provide however lines in form of

www.blahblah.moc        /files/noproblem/file.cgi?lala=cucu&bebe=haha

but also a lot of empty uris, that we are not interested in. The empty uris can be eliminated by piping with the first grep, and the second eliminates the tab (spaces) between the two displayed fields.

sudo tshark -i eth0  -d tcp.port==80,http -T fields -ehttp.host -e http.request.uri | grep -e “[a-zA-Z0-0.\-\/_]” | sed -e ’s/\t//’

this needs a last fix, we need to escape the & characters.

sudo tshark -i eth0  -d tcp.port==80,http -T fields -ehttp.host -e http.request.uri | grep -e “[a-zA-Z0-0.\-\/_]” | sed -e ’s/\t//’ | sed -e ’s/\&/\\&/g’

the latest version will show you all the requests  your browser issues. Now depending on the tube tube site you are using, you have to observe what can be the link to the video. In most of the cases the link contains the word “video” so a last grep with “video” will reduce the number of links suggested.

What you also can do, redirect the output of the latest form to a fail, and on another terminal issue:

tail -f links | xargs -i wget {}