Icecast Streaming Media Server

[Anonymous]

1. I can see http://xxx.xxx.xx.xxx:8000/admin/stats.xsl from the local serer but not from another server on the same subnet. Please help me figure out what I am doing wrong.

2. I am running icecast on a Fedora 6, 32 bit. I installed it via the yum command.

3. Since I am having problems I reveted back to the basic icecast.xml file. I changed the passwords, the log locations and subitutated <localhost> to be my hostname. I have included the icecastl.xml file in this post at the bottom.

4. Here are the results from netstat -tnpl. Thanks to Karl for posting this command!

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 21794/icecast
tcp 0 0 127.0.0.1:2208 0.0.0.0:* LISTEN 2015/hpiod
tcp 0 0 0.0.0.0:744 0.0.0.0:* LISTEN 1834/rpc.statd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1815/portmap
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 26797/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2057/sendmail: acce
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 21296/1
tcp 0 0 127.0.0.1:6011 0.0.0.0:* LISTEN 21296/1
tcp 0 0 127.0.0.1:6012 0.0.0.0:* LISTEN 21618/2
tcp 0 0 127.0.0.1:40956 0.0.0.0:* LISTEN 2020/python
tcp 0 0 :::22 :::* LISTEN 2039/sshd
tcp 0 0 ::1:6010 :::* LISTEN 21296/1
tcp 0 0 ::1:6011 :::* LISTEN 21296/1
tcp 0 0 ::1:6012 :::* LISTEN 21618/2

5. Here is the restult from iptables -L:

Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

6. I start icecast from a script in /etc/init.d and do not receive any errors when I start. Debug level is 4.

7. Here is the bottom of my error.log file:

[2007-03-27 11:49:36] INFO sighandler/_sig_die Caught signal 15, shutting down...
[2007-03-27 11:49:36] DBUG connection/_handle_connection Connection thread done
[2007-03-27 11:49:36] INFO main/main Shutting down
[2007-03-27 11:49:36] INFO fserve/fserve_shutdown file serving thread stopped
[2007-03-27 11:49:36] DBUG slave/slave_shutdown waiting for slave thread
[2007-03-27 11:49:37] DBUG slave/_slave_thread shutting down current relays
[2007-03-27 11:49:37] INFO slave/_slave_thread Slave thread shutdown complete
[2007-03-27 11:49:37] INFO auth/auth_run_thread Authenication thread shutting down
[2007-03-27 11:49:37] INFO auth/auth_shutdown Auth thread has terminated
[2007-03-27 11:49:37] INFO yp/yp_shutdown YP thread down
[2007-03-27 11:49:37] INFO stats/stats_shutdown stats thread finished
[2007-03-27 11:49:43] INFO main/main Icecast 2.3.1 server started
[2007-03-27 11:49:43] DBUG yp/yp_recheck_config Updating YP configuration
[2007-03-27 11:49:43] INFO fserve/fserv_thread_function file serving thread started
[2007-03-27 11:49:43] INFO yp/yp_update_thread YP update thread started
[2007-03-27 11:49:43] INFO auth/auth_run_thread Authentication thread started
[2007-03-27 11:49:44] DBUG slave/_slave_thread checking master stream list

I also see lots of this line:
[2007-03-27 12:07:58] DBUG slave/_slave_thread checking master stream list

8. My icecast.xml file:

<icecast>
<limits>
<clients>100</clients>
<sources>2</sources>
<threadpool>5</threadpool>
<queue-size>524288</queue-size>
<client-timeout>30</client-timeout>
<header-timeout>15</header-timeout>
<source-timeout>10</source-timeout>
<!-- same as burst-on-connect, but this allows for being more
specific on how much to burst. Most people won't need to
change from the default 64k. Applies to all mountpoints -->
<burst-size>65535</burst-size>
</limits>

<authentication>
<!-- Sources log in with username 'source' -->
<source-password>hackme</source-password>
<!-- Relays log in username 'relay' -->
<relay-password>hackme</relay-password>

<!-- Admin logs in with the username given below -->
<admin-user>admin</admin-user>
<admin-password>hackme</admin-password>
</authentication>

<!-- Uncomment this if you want directory listings -->
<!--
<directory>
<yp-url-timeout>15</yp-url-timeout>
<yp-url>http://dir.xiph.org/cgi-bin/yp-cgi</yp-url>
</directory>
<directory>
<yp-url-timeout>15</yp-url-timeout>
<yp-url>http://www.oddsock.org/cgi-bin/yp-cgi</yp-url>
</directory>
-->

<!-- This is the hostname other people will use to connect to your server.
It affects mainly the urls generated by Icecast for playlists and yp
listings. -->
<hostname>myserver.com</hostname>

<!-- You can use these two if you only want a single listener -->
<!--<port>8000</port> -->
<!--<bind-address>127.0.0.1</bind-address>-->



<!-- You may have multiple <listener> elements -->
<listen-socket>
<port>8000</port>
<!-- <bind-address>127.0.0.1</bind-address> -->
</listen-socket>
<!--
<listen-socket>
<port>8001</port>
</listen-socket>
-->

<!--<master-server>127.0.0.1</master-server>-->
<!--<master-server-port>8001</master-server-port>-->
<!--<master-update-interval>120</master-update-interval>-->
<!--<master-password>hackme</master-password>-->
<!--<master-relay-auth>1</master-relay-auth>-->

<!-- setting this makes all relays on-demand unless overridden, this is
useful for master relays which do not have <relay> definitions here.
The default is 0 -->
<!--<relays-on-demand>1</relays-on-demand>-->

<!-- Report <hostname> and this port to master server for redirecting
clients to this slave -->
<!--<master-redirect-port>8000</master-redirect-port>-->

<!-- Relays. State connection information, and by default
request inline metadata for mp3 streams if available.
An on-demand relay will only retrieve the stream if
there are listeners connected -->
<!--
<relay>
<server>127.0.0.1</server>
<port>8001</port>
<mount>/example.ogg</mount>
<local-mount>/different.ogg</local-mount>
<on-demand>1</on-demand>

<relay-shoutcast-metadata>0</relay-shoutcast-metadata>
</relay>
-->

<!-- Only define a <mount> section if you want to use advanced options,
like alternative usernames or passwords
<mount>
<mount-name>/example-complex.ogg</mount-name>

<username>othersource</username>
<password>hackmemore</password>

<max-listeners>1</max-listeners>
<dump-file>/tmp/dump-example1.ogg</dump-file>
<burst-size>65536</burst-size>
<fallback-mount>/example2.ogg</fallback-mount>
<fallback-override>1</fallback-override>
<fallback-when-full>1</fallback-when-full>
<intro>/path/to/stream-intro.ogg</intro>
<hidden>1</hidden>
<authentication type="htpasswd">
<option name="filename" value="myauth"/>
<option name="allow_duplicate_users" value="0"/>
</authentication>
<on-connect>/home/icecast/bin/stream-start</on-connect>
<on-disconnect>/home/icecast/bin/stream-stop</on-disconnect>
</mount>
-->
<!-- other auth possibilities include running a command
to do the auth, mount, user and pass are passed via
stdin to the program
<mount>
....
<authentication type="command">
<option name="filename" value="auth_verify"/>
</authentication>

or

for url auth, the add url needs to return a "icecast-auth-user: 1" http
header for a user to authenicate. Both urls are sent params via POST,
add is sent id, mount, user, pass, ip, useragent
remove is passed id, mount, user, pass, duration

<authentication type="url">

state username/password if url requires it

<option name="username" value="admin"/>
<option name="password" value="hackme"/>
<option name="add" value="http://myauthserver.com/scripts/add_listener.php"/>
<option name="remove" value="http://myauthserver.com/scripts/del_listener.php"/>
</authentication>
</mount -->


<fileserve>1</fileserve>

<!-- set the mountpoint for a shoutcast source to use, the default if not
specified is /stream but you can change it here if an alternative is
wanted or an extension is required
<shoutcast-mount>/live.nsv</shoutcast-mount>
-->

<paths>
<!-- basedir is only used if chroot is enabled -->
<basedir>/usr/share/icecast</basedir>

<!-- Note that if <chroot> is turned on below, these paths must both
be relative to the new root, not the original root -->
<logdir>/var/log/icecast</logdir>
<webroot>/usr/share/icecast/web</webroot>
<adminroot>/usr/share/icecast/admin</adminroot>
<pidfile>/var/run/icecast/icecast.pid</pidfile>

<!-- Aliases: treat requests for 'source' path as being for 'dest' path
May be made specific to a port or bound address using the "port"
and "bind-address" attributes.
-->
<!--
<alias source="/foo" dest="/bar"/>
-->
<!-- Aliases: can also be used for simple redirections as well,
this example will redirect all requests for http://server:port/ to
the status page
-->
<alias source="/" dest="/status.xsl"/>
</paths>

<logging>
<accesslog>access.log</accesslog>
<errorlog>error.log</errorlog>
<playlistlog>playlist.log</playlistlog>
<loglevel>4</loglevel> <!-- 4 Debug, 3 Info, 2 Warn, 1 Error -->
</logging>

<security>
<chroot>0</chroot>
<changeowner>
<user>icecast</user>
<group>icecast</group>
</changeowner>
</security>
</icecast>

[karlH]

I'm guessing it's because your firewall is not letting port 8000 through. The netstat shows that icecast is listening and the logs show no access from any clients which indicates that the connections are not getting to icecast therefore it's a network issue and firewall is most likely.

karl.

[Anonymous]

I checked with my network folks before I posted. They said that 8000 is not blocked. The icecast server and my PC are on the same subnet. I will go quiz them again.

Could my Linux box be blocking the connection?

[karlH]

you can use 'tcpdump -i eth0 -n port 8000' (as root) to monitor the packets getting to your network device, they will show even if linux itself is blocking the connection. If you see a connection appearing then it's your firewall, if not then it must be something further up the network (eg a NAT).

karl.

[Anonymous]

Here is what I got. I did not get anything when I went to my local server. I need to read about tcpdump to understand what it is telling me. There is nothing obverious here for me.

Thanks for the help!

Peggy

[root@video ~]# tcpdump -i eth0 -n port 8000 -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

13:50:56.510491 IP (tos 0x0, ttl 128, id 61936, offset 0, flags [DF], proto: TCP (6), length: 48 ) my.pc.ip.netopia-vo3 > icecast.server.ip.irdmi: S, cksum 0xd608 (correct), 1116178500:1116178500(0) win 65535 <mss 1460,nop,nop,sackOK>

13:50:59.430447 IP (tos 0x0, ttl 128, id 15543, offset 0, flags [DF], proto: TCP (6), length: 48 ) my.pc.ip.netopia-vo3 > icecast.server.ip.irdmi: S, cksum 0xd608 (correct), 1116178500:1116178500(0) win 65535 <mss 1460,nop,nop,sackOK>

13:51:05.365324 IP (tos 0x0, ttl 128, id 19771, offset 0, flags [DF], proto: TCP (6), length: 48 ) my.pc.ip.netopia-vo3 > icecast.server.ip.irdmi: S, cksum 0xd608 (correct), 1116178500:1116178500(0) win 65535 <mss 1460,nop,nop,sackOK>

[karlH]

I'm not sure what you mean by "I did not get anything when I went to my local server.", but the tcpdump output just means that one machine (my.pc.ip) tried to initiate a connection to another (icecast.server.ip) on port 8000 but no reply was seen. If this was run on the machine with icecast on it then the firewall is blocking the connection from getting to icecast.

karl.

[Anonymous]

I found out that it was my linux box that had the firewall. I went into to /etc/sysconfig and moved iptables to xxx.iptables. I rebooted and now I can access my icecast server from other machines.

I still need to fiure out which firewall settings I need, but I am now moving forward. Next task to conquer is seeing if an video encoding client can talk to the icecast server.

Thanks for the help and prompt responses!

Peggy