X-Git-Url: https://git.teslayout.com/public/public/public/?a=blobdiff_plain;f=example%2Fdiameter%2Flauncher%2Fresources%2Fpcap2diameterHex.sh;h=355b70f657d304801632a56850ca1413859ed6f6;hb=a8cde75abebb30020be4d9cb10d898f8986e124c;hp=b843db3a16d69cc503861a41be518da8bf1850b6;hpb=a42ec960225235d9d044b5d71e9bfc847374d7cd;p=anna.git diff --git a/example/diameter/launcher/resources/pcap2diameterHex.sh b/example/diameter/launcher/resources/pcap2diameterHex.sh index b843db3..355b70f 100755 --- a/example/diameter/launcher/resources/pcap2diameterHex.sh +++ b/example/diameter/launcher/resources/pcap2diameterHex.sh @@ -99,19 +99,20 @@ RESULTS_DIR=`dirname $PCAP_FILE` # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): -FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" +FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.length" +FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment" tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: -# /length\ -# frame timestamp src dst App-ID TCP DIAM protocol segments -# 1|1427215933.697904000|gt_traf|vcbavipt|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 3|1427215934.449523000|vcbavipt|gt_traf|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 5|1427215934.456160000|gt_traf|vcbavipt||1400||eth:ip:tcp:diameter| -# 6|1427215934.456204000|gt_traf|vcbavipt|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 -# 8|1427215935.123559000|vcbavipt|gt_traf|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| +# /length\ +# frame timestamp src dst code R App-ID HopByHop EndToEnd DIAM TCP protocol segments +# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 5|1427215934.456160000|gt_traf|vcbavipt|||||||1400|eth:ip:tcp:diameter| +# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f9) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($7 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f13) ) +main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 != "") print $1 }') ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -126,7 +127,7 @@ for frame in ${all_frames[@]}; do frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) # Get the diameter part: - tcp_len=$(echo $frame_info | cut -d\| -f6) + tcp_len=$(echo $frame_info | cut -d\| -f11) frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') cut_len=$((frm_len-2*tcp_len)) cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex @@ -137,8 +138,25 @@ for frame in ${all_frames[@]}; do date=$(date -d @$ts) src=$(echo $frame_info | cut -d\| -f3) dst=$(echo $frame_info | cut -d\| -f4) - appid=$(echo $frame_info | cut -d\| -f5) - echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata + code=$(echo $frame_info | cut -d\| -f5) + isreq=$(echo $frame_info | cut -d\| -f6) + appid=$(echo $frame_info | cut -d\| -f7) + hbh=$(echo $frame_info | cut -d\| -f8) + e2e=$(echo $frame_info | cut -d\| -f9) + # To decimal: + hbh=$(printf "%d\n" $hbh) + e2e=$(printf "%d\n" $e2e) + echo "date=$date" > $RESULTS_DIR/$frame.metadata + echo "timestamp=$ts" >> $RESULTS_DIR/$frame.metadata + echo "src=$src" >> $RESULTS_DIR/$frame.metadata + echo "dst=$dst" >> $RESULTS_DIR/$frame.metadata + echo "code=$code" >> $RESULTS_DIR/$frame.metadata + echo "isrequest=$isreq" >> $RESULTS_DIR/$frame.metadata + echo "applicationid=$appid" >> $RESULTS_DIR/$frame.metadata + #echo "sequence=${hbh}.${e2e}" >> $RESULTS_DIR/$frame.metadata +# echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata +# echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata + echo " and $RESULTS_DIR/$frame.metadata" done @@ -154,7 +172,7 @@ done # Delete superfluous metadata: echo "Deleting superfluous buffers & metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($7 == "") print $1 }') ) +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($10 == "") print $1 }') ) for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done