--- title: "Hijacking the PS5's RTMP Stream" slug: hijacking-the-ps5s-rtmp-stream url: https://listedarticles.com/articles/hijacking-the-ps5s-rtmp-stream canonical_url: https://yashgarg.dev/posts/hijacking-ps5-rtmp-stream/ content_type: blog_post language: en published_at: 2026-09-28T12:00:00.000Z updated_at: 2026-09-28T12:16:33.095Z author: "Yash Garg" authored_by: human publisher: "yashgarg.dev" publisher_url: https://yashgarg.dev topics: ["Security", "Reverse Engineering", "Gaming", "Networking"] license: all-rights-reserved word_count: 1016 reading_minutes: 4 citation: "Yash Garg, yashgarg.dev. \"Hijacking the PS5's RTMP Stream.\" 28 Sept 2026. https://yashgarg.dev/posts/hijacking-ps5-rtmp-stream/ (all-rights-reserved)" # The full text follows. The web page shows an extract and sends readers # to the source above; quote the citation and link the canonical URL. --- # Hijacking the PS5's RTMP Stream > How the PS5 Broadcast RTMP pipeline can be intercepted and redirected: reverse-engineering the stream path and what that unlocks. ## Contents Sony has progressively locked down what you can do with the PS5’s hardware. Streaming is a good example: the console gives you a nice, convenient **“Broadcast”** button, but the moment you want to do anything outside the handful of services Sony supports, it gets annoying very fast. Third-party Bluetooth devices are the same story! Sony locks the wireless stack to their own peripherals, so your headphones or controllers from other brands simply won’t pair :/ ## [#](https://yashgarg.dev#the-problem)The Problem I often stream games with friends on [Discord](https://discord.com) who watch me play, but the PS5 doesn’t support screen sharing to Discord. The obvious fix is a capture card — plug the HDMI output into a [capture card](https://www.elgato.com/us/en/explorer/products/capture/what-is-a-capture-card/), feed it into [OBS](https://obsproject.com/) on your Mac, stream from there. But decent ones aren’t cheap, and I didn’t want to spend upwards of $100 just for this. ## [#](https://yashgarg.dev#remote-play)Remote Play [Remote Play](https://www.playstation.com/en-in/remote-play/) somewhat worked for me. I could connect the PS5 to my MacBook, share the Mac’s screen to Discord and play from there. The problem is that you need to connect everything to the Remote Play device: controller, earphones, etc. I also occasionally ran into input lag, and the stream quality is entirely controlled by the PS5. You can’t really configure anything. I didn’t want to change my physical setup every time I wanted to stream. ## [#](https://yashgarg.dev#how-ps5-streaming-works)How PS5 Streaming Works The PS5 supports streaming to [YouTube](https://youtube.com) and [Twitch](https://twitch.tv) by default if you’re signed into those accounts. The protocol used for this is [RTMP](https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol), or Real-Time Messaging Protocol, which is commonly used for live audio/video streaming. So when you start a broadcast, the PS5 roughly does this: What if we could make our own device act as Twitch and receive that RTMP stream instead? That’s the idea. The PS5 doesn’t hardcode Twitch’s IP, it looks it up via DNS every time. If we control what DNS returns, we control where the stream goes. ## [#](https://yashgarg.dev#finding-the-right-hostname)Finding the Right Hostname The obvious first attempt was to spoof `ingest.twitch.tv` directly. That’s the hostname the PS5 resolves when you hit broadcast, so pointing it at the Mac should work, right? Not quite. `ingest.twitch.tv:443` is actually a **discovery endpoint**, not the RTMP server itself. The PS5 makes an HTTPS call to it asking “which regional ingest server should I use?”. Twitch responds with something like `ap-southeast-1.prod.fi.contribute.live-video.net`. Then the PS5 pushes the actual stream there. Spoofing that hostname ran into a different problem: the actual Twitch ingest uses **RTMPS** (RTMP over TLS on port 443), and the PS5 validates the certificate against trusted [CAs](https://en.wikipedia.org/wiki/Certificate_authority). A self-signed cert doesn’t work, and there’s no way to install custom CAs on a PS5. I then tried YouTube as a workaround. YouTube’s RTMP ingest uses plain RTMP on port 1935 with no TLS, so the stream came through fine. But the PS5 stopped the broadcast after about 60 seconds because it periodically checks YouTube’s API to confirm the stream is actually live. Since we intercepted it, YouTube never saw it, so the API returned nothing and the PS5 gave up. The actual fix came from watching DNS logs while broadcasting: ``` sudo tail -f /tmp/dnsmasq.log # Sep 22 23:20:28 dnsmasq: query[A] ingest.global-contribute.live-video.net from 192.168.8.171 # Sep 22 23:20:28 dnsmasq: reply aps30.contribute.live-video.net is 35.55.13.0 ``` The PS5 was resolving `ingest.global-contribute.live-video.net`, which chains down to `aps30.contribute.live-video.net`. That’s the real RTMP server. Spoofing `contribute.live-video.net` covers all subdomains and redirects the actual stream to the Mac without any certificate issues. ## [#](https://yashgarg.dev#dns-trick)DNS Trick The setup has two main parts: [`dnsmasq`](https://dnsmasq.org) and [`nginx-rtmp`](https://github.com/arut/nginx-rtmp-module). I built a small macOS menu bar app that bundles both and manages them. I run `dnsmasq` on my Mac and configure it to resolve Twitch’s ingest domains to my Mac’s LAN address: ``` server=1.1.1.1 server=8.8.8.8 # Redirect Twitch ingest traffic to the Mac address=/contribute.live-video.net/192.168.8.175 address=/ingest.global-contribute.live-video.net/192.168.8.175 address=/live.twitch.tv/192.168.8.175 address=/live-sin.twitch.tv/192.168.8.175 address=/live-nrt.twitch.tv/192.168.8.175 address=/live-syd.twitch.tv/192.168.8.175 address=/live-fra.twitch.tv/192.168.8.175 address=/live-ams.twitch.tv/192.168.8.175 address=/live-lhr.twitch.tv/192.168.8.175 address=/live-jfk.twitch.tv/192.168.8.175 address=/live-lax.twitch.tv/192.168.8.175 address=/live-sea.twitch.tv/192.168.8.175 log-queries log-facility=/tmp/dnsmasq.log no-hosts listen-address=0.0.0.0 ``` `192.168.8.175` is my Mac’s IP. When the PS5 asks DNS for one of these Twitch endpoints, `dnsmasq` returns my Mac’s IP instead. The PS5 connects to my Mac thinking it’s Twitch. The last piece is pointing the PS5 at this DNS server. I have a [GL.iNet router](https://www.gl-inet.com/) running [OpenWRT](https://openwrt.org/), so I configured it to hand my Mac’s IP as the DNS server specifically for the PS5’s [DHCP](https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol) lease. ``` # SSH into the router and run: uci add_list dhcp.lan.dhcp_option="tag:PS5,6,192.168.8.175" uci commit dhcp /etc/init.d/dnsmasq restart ``` The `tag:PS5` part works because the PS5’s static lease already has that tag set in `/etc/config/dhcp`. Option `6` is the DHCP option for DNS server. The PS5 picks this up on its next DHCP renewal, no manual DNS configuration is required on the console! ## [#](https://yashgarg.dev#receiving-the-stream)Receiving the Stream For that, I’m using `nginx-rtmp`: ``` worker_processes 1; error_log /tmp/nginx-error.log warn; pid /tmp/nginx.pid; events { worker_connections 512; } rtmp { server { listen 1935; chunk_size 4096; application app { live on; record off; sync 10ms; # Notify our app when a stream starts on_publish http://127.0.0.1:9988/on_publish; } } } http { server { listen 8080; location /stat { rtmp_stat all; } } } ``` The `on_publish` callback is how the menu bar app detects when the PS5 starts broadcasting. nginx fires a POST to `localhost:9988` with the stream name, and the app surfaces the full RTMP URL ready to copy. At this point, the PS5 is pushing its stream (1080p60, H.264, AAC stereo) directly to my Mac instead of Twitch. From here I can pull the stream into anything: OBS to re-stream it, record it locally, or just play it directly. ## [#](https://yashgarg.dev#watching-it)Watching It Instead of going through OBS, I used [`mpv`](https://mpv.io/) to pull the stream and shared the window to Discord. The low-latency profile keeps the delay less than a second: `mpv --profile=low-latency --audio-buffer=0.3 rtmp://127.0.0.1/app/` This has been quite reliable surprisingly. I’ve been using it for a few weeks now and haven’t had any issues. You can find the complete source code [here](https://github.com/yash-garg/PS5Streamer). *Until next time! 👋*