X-Git-Url: https://git.teslayout.com/public/public/public/?a=blobdiff_plain;f=example%2Fdiameter%2Flauncher%2Fresources%2Fpcap2diameterHex.sh;fp=example%2Fdiameter%2Flauncher%2Fresources%2Fpcap2diameterHex.sh;h=05023f849c4955ad7279ef3b17796ae581f18708;hb=20a26fbedc55c5211a005b80098b094f8ff3fa4c;hp=07c0982724c9961e12668844b4f4c73de54b01a4;hpb=226eec72ef6510cad247f4c553daf6d1d93a149c;p=anna.git

diff --git a/example/diameter/launcher/resources/pcap2diameterHex.sh b/example/diameter/launcher/resources/pcap2diameterHex.sh
index 07c0982..05023f8 100755
--- a/example/diameter/launcher/resources/pcap2diameterHex.sh
+++ b/example/diameter/launcher/resources/pcap2diameterHex.sh
@@ -99,19 +99,19 @@ RESULTS_DIR=`dirname $PCAP_FILE`
 
 # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames):
 # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough):
-FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.flags.request -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment"
+FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment"
 tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
 # Example output:
-#                                           /length\
-# frame     timestamp        src     dst    R  App-ID  TCP DIAM          protocol                         segments 
-#   1|1427215933.697904000|gt_traf|vcbavipt|1|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
-#   3|1427215934.449523000|vcbavipt|gt_traf|0|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
-#   5|1427215934.456160000|gt_traf|vcbavipt|||1400||eth:ip:tcp:diameter|
-#   6|1427215934.456204000|gt_traf|vcbavipt|1|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
-#   8|1427215935.123559000|vcbavipt|gt_traf|0|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
+#                                                          /length\
+# frame     timestamp        src     dst   code R  App-ID  TCP DIAM          protocol                         segments 
+#   1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
+#   3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
+#   5|1427215934.456160000|gt_traf|vcbavipt||||1400||eth:ip:tcp:diameter|
+#   6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
+#   8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
 all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) )
-needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f10) )
-main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if (8 != "") print $1 }') )
+needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f11) )
+main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($9 != "") print $1 }') )
 
 # Reassemble procedure (using frame 1 as example):
 # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself)
@@ -126,7 +126,7 @@ for frame in ${all_frames[@]}; do
   frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames)
 
   # Get the diameter part:
-  tcp_len=$(echo $frame_info | cut -d\| -f7)
+  tcp_len=$(echo $frame_info | cut -d\| -f8)
   frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }')
   cut_len=$((frm_len-2*tcp_len))
   cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex
@@ -137,9 +137,10 @@ for frame in ${all_frames[@]}; do
   date=$(date -d @$ts)
   src=$(echo $frame_info | cut -d\| -f3)
   dst=$(echo $frame_info | cut -d\| -f4)
-  isreq=$(echo $frame_info | cut -d\| -f5)
-  appid=$(echo $frame_info | cut -d\| -f6)
-  echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\nisrequest=$isreq\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata
+  code=$(echo $frame_info | cut -d\| -f5)
+  isreq=$(echo $frame_info | cut -d\| -f6)
+  appid=$(echo $frame_info | cut -d\| -f7)
+  echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\ncode=$code\nisrequest=$isreq\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata
   echo " and $RESULTS_DIR/$frame.metadata"
 done
 
@@ -155,7 +156,7 @@ done
 
 # Delete superfluous metadata:
 echo "Deleting superfluous buffers & metadata ..."
-segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($8 == "") print $1 }') )
+segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($9 == "") print $1 }') )
 for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done