turnerm5, that's a really useful hint. After playing with the method you described, I realized that there's a way to get the domain name and URL path without having tcpflow create a bunch of output files to rummage through.

sudo tcpflow -c -i en0 port 80 | grep -oE '\<GET *.*\.mov.*HTTP/1.1 *\>|Host: *.*'

Which will give the following style of ouput:

tcpflow[4139]: listening on en0
Host: ax.moon.xzxzxz.com.xzxzxz.net
Host: metrics.xzxzxz.com
GET /Features/xzxz/xzxz/xzxz/xzxz/dj.xzxzxz.mov HTTP/1.1
Host: xzxz.xzxz.apple.com

Granted, there's still some ambiguity as to which host name to choose, and one still has to reconstruct the final download URL by C&P-ing, but at least it puts everything in one place.

(Of course, the next logical step would be for someone to wrap all this together with a bit of logic in an Applescript or Perl-LWP app or something...)

Hey thanks, I was planning to do it all in one line, just never got around to it. Saved me the time!

maybe it is better if it is kept difficult... that way this way won't be plugged in the next version of iTunes....