[version (1 byte)] [1st timestamp (4 bytes)] [2nd timestamp (4 bytes)] [1528 bytes of random data]
The handshake process is client sends a handhsake request to the server. This is 1537 bytes (version + handshake). The server then responds with a 3073 byte packet, which is the version byte plus two 1536 byte packets, the second one being the the same random data as we originally sent, but with the header changed.
An RTMP packet has a variablew length header field, followed by data encoded in AMF format. The header can be one of 1, 4, 8, or 12 bytes.