#!/bin/bash
+# ANNA - Anna is Not Nothingness Anymore
+#
+# (c) Copyright 2005-2014 Eduardo Ramos Testillano & Francisco Ruiz Rayo
+#
+# http://redmine.teslayout.com/projects/anna-suite
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of the copyright holder nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Authors: eduardo.ramos.testillano@gmail.com
+# cisco.tierra@gmail.com
+
+
#############
# VARIABLES #
#############
# Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames):
# Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough):
-FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment"
+FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment"
tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
# Example output:
-# /length\
-# frame timestamp src dst TCP DIAM protocol segments
-# 1|1427215933.697904000|gt_traf|vcbavipt|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
-# 3|1427215934.449523000|vcbavipt|gt_traf|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
-# 5|1427215934.456160000|gt_traf|vcbavipt|1400||eth:ip:tcp:diameter|
-# 6|1427215934.456204000|gt_traf|vcbavipt|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
-# 8|1427215935.123559000|vcbavipt|gt_traf|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# /length\
+# frame timestamp src dst code R App-ID TCP DIAM protocol segments
+# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# 5|1427215934.456160000|gt_traf|vcbavipt||||1400||eth:ip:tcp:diameter|
+# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
+# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) )
-needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f8) )
-main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 != "") print $1 }') )
+needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f11) )
+main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($9 != "") print $1 }') )
# Reassemble procedure (using frame 1 as example):
# (for non segmented frames, it is enough with tcp or diameter length within the frame content itself)
frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames)
# Get the diameter part:
- tcp_len=$(echo $frame_info | cut -d\| -f5)
+ tcp_len=$(echo $frame_info | cut -d\| -f8)
frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }')
cut_len=$((frm_len-2*tcp_len))
cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex
date=$(date -d @$ts)
src=$(echo $frame_info | cut -d\| -f3)
dst=$(echo $frame_info | cut -d\| -f4)
- echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst" > $RESULTS_DIR/$frame.metadata
+ code=$(echo $frame_info | cut -d\| -f5)
+ isreq=$(echo $frame_info | cut -d\| -f6)
+ appid=$(echo $frame_info | cut -d\| -f7)
+ echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\ncode=$code\nisrequest=$isreq\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata
echo " and $RESULTS_DIR/$frame.metadata"
done
done
# Delete superfluous metadata:
-echo "Deleting superfluous metadata ..."
-segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 == "") print $1 }') )
-for s in ${segments[@]}; do rm $RESULTS_DIR/$s.metadata; done
+echo "Deleting superfluous buffers & metadata ..."
+segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($9 == "") print $1 }') )
+for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done
_exit "Done!" 0
projects / anna.git / blobdiff