X-Git-Url: https://git.teslayout.com/public/public/public/?a=blobdiff_plain;f=example%2Fdiameter%2Flauncher%2Fresources%2Fpcap2diameterHex.sh;h=05023f849c4955ad7279ef3b17796ae581f18708;hb=4a6b159e05fed37e40d586b938c31a22fe82d3d0;hp=25c247e38c4a270e9d037271b93d5b43648d800e;hpb=54e20da56b7c20a85814893359a02c6262d29756;p=anna.git diff --git a/example/diameter/launcher/resources/pcap2diameterHex.sh b/example/diameter/launcher/resources/pcap2diameterHex.sh index 25c247e..05023f8 100755 --- a/example/diameter/launcher/resources/pcap2diameterHex.sh +++ b/example/diameter/launcher/resources/pcap2diameterHex.sh @@ -1,5 +1,41 @@ #!/bin/bash +# ANNA - Anna is Not Nothingness Anymore +# +# (c) Copyright 2005-2014 Eduardo Ramos Testillano & Francisco Ruiz Rayo +# +# http://redmine.teslayout.com/projects/anna-suite +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# * Neither the name of the copyright holder nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +# Authors: eduardo.ramos.testillano@gmail.com +# cisco.tierra@gmail.com + + ############# # VARIABLES # ############# @@ -38,16 +74,6 @@ _exit () { exit $rc } -# $1: string; $2: substring -get_str_pos() { - local result=-1 - local str=$1 - local substr="${1%%$2*}" - local pos=${#substr} - local size=${#str} - [ $size -ne $pos ] && result=$pos - echo $result -} ############# # EXECUTION # @@ -73,19 +99,19 @@ RESULTS_DIR=`dirname $PCAP_FILE` # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): -FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" +FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: -# /length\ -# frame timestamp src dst TCP DIAM protocol segments -# 1|1427215933.697904000|gt_traf|vcbavipt|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 3|1427215934.449523000|vcbavipt|gt_traf|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 5|1427215934.456160000|gt_traf|vcbavipt|1400||eth:ip:tcp:diameter| -# 6|1427215934.456204000|gt_traf|vcbavipt|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 -# 8|1427215935.123559000|vcbavipt|gt_traf|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| +# /length\ +# frame timestamp src dst code R App-ID TCP DIAM protocol segments +# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 5|1427215934.456160000|gt_traf|vcbavipt||||1400||eth:ip:tcp:diameter| +# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f8) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f11) ) +main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($9 != "") print $1 }') ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -100,7 +126,7 @@ for frame in ${all_frames[@]}; do frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) # Get the diameter part: - tcp_len=$(echo $frame_info | cut -d\| -f5) + tcp_len=$(echo $frame_info | cut -d\| -f8) frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') cut_len=$((frm_len-2*tcp_len)) cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex @@ -111,7 +137,10 @@ for frame in ${all_frames[@]}; do date=$(date -d @$ts) src=$(echo $frame_info | cut -d\| -f3) dst=$(echo $frame_info | cut -d\| -f4) - echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst" > $RESULTS_DIR/$frame.metadata + code=$(echo $frame_info | cut -d\| -f5) + isreq=$(echo $frame_info | cut -d\| -f6) + appid=$(echo $frame_info | cut -d\| -f7) + echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\ncode=$code\nisrequest=$isreq\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata echo " and $RESULTS_DIR/$frame.metadata" done @@ -126,9 +155,9 @@ for group in ${needs_join[@]}; do done # Delete superfluous metadata: -echo "Deleting superfluous metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 == "") print $1 }') ) -for s in ${segments[@]}; do rm $RESULTS_DIR/$s.metadata; done +echo "Deleting superfluous buffers & metadata ..." +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($9 == "") print $1 }') ) +for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done _exit "Done!" 0