# Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames):
# Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): see https://www.wireshark.org/docs/dfref/d/diameter.html
-FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.Origin-Host -e diameter.length"
+FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.Origin-Host -e diameter.Subscription-Id-Data -e diameter.Subscription-Id-Type -e diameter.length"
FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment"
# Disect selectors for non-standard diameter ports:
for port in $OTHER_PORTS
$TSHARK -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
# Example output:
-# /length\
-# frame timestamp src dst code R App-ID HopByHop EndToEnd Session-Id Origin-Host DIAM TCP protocol segments
-# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
-# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
-# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# /length\
+# frame timestamp src dst code R App-ID HopByHop EndToEnd Session-Id Origin-Host Subs-Data Subs-Type DIAM TCP protocol segments
+# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
+# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
# 5|1427215934.456160000|gt_traf|vcbavipt||||||||1400|eth:ip:tcp:diameter|
-# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
-# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
+# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) )
-needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f15) )
-main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($13 != "") print $1 }') )
+needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f17) )
+main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($15 != "") print $1 }') )
# Reassemble procedure (using frame 1 as example):
# (for non segmented frames, it is enough with tcp or diameter length within the frame content itself)
frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames)
# Get the diameter part:
- tcp_len=$(echo $frame_info | cut -d\| -f13)
+ tcp_len=$(echo $frame_info | cut -d\| -f15)
frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }')
cut_len=$((frm_len-2*tcp_len))
cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex
appid=$(echo $frame_info | cut -d\| -f7)
sid=$(echo $frame_info | cut -d\| -f10)
oh=$(echo $frame_info | cut -d\| -f11)
+ subscriber=$(echo $frame_info | cut -d\| -f12)
+ subscribertype=$(echo $frame_info | cut -d\| -f13)
+ [ "$subscribertype" = "0" ] && subscribertype=msisdn
+ [ "$subscribertype" = "1" ] && subscribertype=imsi
+
#hbh=$(echo $frame_info | cut -d\| -f8)
#e2e=$(echo $frame_info | cut -d\| -f9)
# HBH and ETE To decimal:
echo "applicationid=$appid" >> $RESULTS_DIR/$frame.metadata
[ -n "$sid" ] && echo "sessionid=$sid" >> $RESULTS_DIR/$frame.metadata
echo "originhost=$oh" >> $RESULTS_DIR/$frame.metadata
+ if [ -n "$subscriber" ]
+ then
+ echo "subscriber=$subscriber" >> $RESULTS_DIR/$frame.metadata
+ echo "subscribertype=$subscribertype" >> $RESULTS_DIR/$frame.metadata
+ fi
#echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata
#echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata
# Delete superfluous metadata:
echo "Deleting superfluous buffers & metadata ..."
-segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($12 == "") print $1 }') )
+segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($14 == "") print $1 }') )
for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done
# Detecting Session-Id values: