Ghost Downloader

Sniffing Page Media

How the browser extension discovers media on a page, and how different video formats (HLS, DASH, muxed) affect download behavior.

How the Extension Discovers Media

The browser extension captures downloadable resources on a page through two paths:

  • Network request capture — The extension monitors network requests made by the browser and identifies media resources by MIME type and file extension. Network traffic generated during video or audio playback is captured automatically and appears in the Resources panel of the extension popup.
  • MSE Probe — For video played using Media Source Extensions (MSE), the extension injects a page script that tracks the associations between MediaSource, SourceBuffer, and network requests, attributing network URLs to specific <video> elements.

The two paths work independently: network capture results go into the resource list in the extension popup, while MSE attribution results drive the download button on the page.

Page Download Button

When the mouse hovers over a playing video, a "Download this media" button appears near the video. Clicking it triggers the attribution engine to locate the network resource for that video, then sends it to the desktop app to create a task.

The button selects the active video as follows: among all visible <video> elements, playing videos take priority over paused ones, and larger area takes priority over smaller. Video elements with width below 120px or height below 80px are ignored.

The button can be dragged to a different position. Clicking the x on the right side dismisses the button for the current page; it reappears after a page refresh. The "Media button" toggle in the extension popup can disable this button globally.

HLS, DASH, and Muxed Video

The extension handles different video container formats differently:

FormatHow the extension identifies itDownload behavior
HLS (.m3u8)MIME type application/vnd.apple.mpegurl or .m3u8 in URLSent to the desktop app as a stream; the desktop app parses segments and downloads them
DASH (.mpd)MIME type application/dash+xml or .mpd in URLSame as above, sent as a stream
DASH split tracksVideo and audio are fed into the player through separate SourceBuffer instances, each as independent network requestsThe extension waits until both the video track and audio track are captured, then sends them as a merge task to the desktop app
Muxed MP4A single SourceBuffer containing interleaved audio and videoDownloaded as a single file

When a video has multiple streams (e.g., multiple quality levels each with their own .m3u8), they appear as separate resources in the Resources panel of the extension popup. In this case, you need to manually select the desired quality from the resource list rather than using the page download button.

For DASH split-track videos, the extension must capture both the video track and the audio track before it can send a merge task. If you click the download button after only a few seconds of playback, it may show "Waiting for resource..." because the audio track has not yet been captured. Continue playback for a while and try again.

Site-Specific Handling

The extension has dedicated resolution strategies for the following sites:

  • YouTube — Does not use network capture. YouTube video URLs are cipher-signed and cannot be re-downloaded directly. The extension passes the page URL to yt-dlp on the desktop app.
  • Douyin — Identifies track roles from URL path markers (/media-video-, /media-audio-) and uses the __vid query parameter to handle preload scenarios.
  • Instagram — Distinguishes video and audio tracks via the vencode_tag in the efg parameter.
  • X (Twitter) — Uses a dedicated resolution strategy.

Other sites use the generic strategy: it prefers HLS/DASH streams first, then tries DASH split-track merge, and falls back to a single file.

Sites That Cannot Be Sniffed

Videos protected by DRM (Digital Rights Management) cannot be sniffed. Major Chinese video platforms (Youku, Tencent Video, iQIYI) all use DRM encryption. The extension can capture network requests from these sites but cannot convert them into downloadable resources.

If the extension captures a resource but the downloaded file cannot be played, it is usually because of DRM encryption — the file content is encrypted, and even a complete download cannot be decoded.

Selecting Quality from the Resource List

When a page video has multiple quality levels or bitrates, these variants appear as separate resources in extension popup -> Resources panel. Each resource shows its filename, size, and MIME type.

For DASH split-track videos, both video track and audio track resources appear in the resource list. After selecting one video track and one audio track, you can use the online merge feature to send them as a merge task to the desktop app.

If the page download button shows "Multiple media resources found, please select in the resource sniffer page", the attribution engine could not determine which one to download, and you need to manually select from the resource list.

For how browser download takeover works and the role of draft mode, see Taking Over Browser Downloads.

On this page