X-Git-Url: https://git.teslayout.com/public/public/public/?a=blobdiff_plain;f=example%2Fdiameter%2Flauncher%2Fresources%2Fpcap2diameterHex.sh;h=a318974ec1dd05aee30195780fee2bbb7d3f88e1;hb=93b27b64c8408926b83b4eec78594548bb2ea953;hp=fc217cdc751166ac79d2cb88cf5b17f4caa828c3;hpb=2bbb5ef5ed8fc5997d9c9a973860ca8aae769ad5;p=anna.git diff --git a/example/diameter/launcher/resources/pcap2diameterHex.sh b/example/diameter/launcher/resources/pcap2diameterHex.sh index fc217cd..a318974 100755 --- a/example/diameter/launcher/resources/pcap2diameterHex.sh +++ b/example/diameter/launcher/resources/pcap2diameterHex.sh @@ -1,5 +1,41 @@ #!/bin/bash +# ANNA - Anna is Not Nothingness Anymore +# +# (c) Copyright 2005-2014 Eduardo Ramos Testillano & Francisco Ruiz Rayo +# +# http://redmine.teslayout.com/projects/anna-suite +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# * Neither the name of the copyright holder nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +# Authors: eduardo.ramos.testillano@gmail.com +# cisco.tierra@gmail.com + + ############# # VARIABLES # ############# @@ -63,19 +99,20 @@ RESULTS_DIR=`dirname $PCAP_FILE` # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): -FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" +FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.length" +FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment" tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: -# /length\ -# frame timestamp src dst TCP DIAM protocol segments -# 1|1427215933.697904000|gt_traf|vcbavipt|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 3|1427215934.449523000|vcbavipt|gt_traf|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 5|1427215934.456160000|gt_traf|vcbavipt|1400||eth:ip:tcp:diameter| -# 6|1427215934.456204000|gt_traf|vcbavipt|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 -# 8|1427215935.123559000|vcbavipt|gt_traf|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| +# /length\ +# frame timestamp src dst code R App-ID HopByHop EndToEnd DIAM TCP protocol segments +# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 5|1427215934.456160000|gt_traf|vcbavipt|||||||1400|eth:ip:tcp:diameter| +# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f8) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f13) ) +main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 != "") print $1 }') ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -90,7 +127,7 @@ for frame in ${all_frames[@]}; do frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) # Get the diameter part: - tcp_len=$(echo $frame_info | cut -d\| -f5) + tcp_len=$(echo $frame_info | cut -d\| -f11) frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') cut_len=$((frm_len-2*tcp_len)) cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex @@ -101,7 +138,15 @@ for frame in ${all_frames[@]}; do date=$(date -d @$ts) src=$(echo $frame_info | cut -d\| -f3) dst=$(echo $frame_info | cut -d\| -f4) - echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst" > $RESULTS_DIR/$frame.metadata + code=$(echo $frame_info | cut -d\| -f5) + isreq=$(echo $frame_info | cut -d\| -f6) + appid=$(echo $frame_info | cut -d\| -f7) + hbh=$(echo $frame_info | cut -d\| -f8) + e2e=$(echo $frame_info | cut -d\| -f9) + # To decimal: + hbh=$(printf "%d\n" $hbh) + e2e=$(printf "%d\n" $e2e) + echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\ncode=$code\nisrequest=$isreq\napplicationid=$appid\nhbh.e2e=${hbh}.${e2e}" > $RESULTS_DIR/$frame.metadata echo " and $RESULTS_DIR/$frame.metadata" done @@ -116,9 +161,9 @@ for group in ${needs_join[@]}; do done # Delete superfluous metadata: -echo "Deleting superfluous metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 == "") print $1 }') ) -for s in ${segments[@]}; do rm $RESULTS_DIR/$s.metadata; done +echo "Deleting superfluous buffers & metadata ..." +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($10 == "") print $1 }') ) +for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done _exit "Done!" 0