RTMP use default port 1935 and it has a HTTP tunnel version, RTMPT, which stream media over HTTP protocol via port 80. Also, it has a secure tunnel version, RTMPS, which stream media over HTTP SSL.
In general, RTMP message carry AMF (Action Message Format) packets. AMF is a binary format for serialized Action Script objects. Each RTMP can contains multiple AMF objects.
In general, RTMP communication as follow
1. All communication is started by client (C) to server (S)
2. C start RTMP handshake by sending 1 byte of 0x03 to server (C0). This 1 bytes is a version for RTMP communication. Latest version is version 3
3. C send a data block of 1536 bytes (C1). It contains
4. S will reply with a 1 byte message (S0). It is RTMP version selected by the server
5. Then, S will reply with 2 1536 bytes message to C. First message (S1) has the same format as C1. The second message (S2) is an echo of C1. Below is the packet format for S2
6. C will reply another 1536 bytes message (C2) to S1. It is a echo message of S1.
7. The client and server will check the echo message against their original message. If matched, handshake completed
8. To reduce confusion, below is the handshake diagram.
Reference: Adobe Official RTMP Specification