Allow purge undesirable Session-Id frames

diff --git a/example/diameter/pcapDecoder/tsharkDecoder.sh b/example/diameter/pcapDecoder/tsharkDecoder.sh
index 90c3384..deca8eb 100755 (executable)
--- a/example/diameter/pcapDecoder/tsharkDecoder.sh
+++ b/example/diameter/pcapDecoder/tsharkDecoder.sh
@@ -49,17 +49,20 @@ tmpdir=$(mktemp -d)
 
 usage() {
   echo
-  echo "Usage: $0 [-h|--help] [-o|--other-ports] [-d|--results-dir] <pcap>"
+  echo "Usage: $0 [-h|--help] [-o|--other-ports <list>] [-d|--results-dir <dir>] [-s|--sids <file>] <pcap>"
   echo
-  echo "       -h|--help:        this usage help."
-  echo "       -o|--other-ports: space-separated list of ports which frames"
-  echo "                         will be decoded as diameter protocol although"
-  echo "                         not being standard. For example, we could use"
-  echo "                         \"13868\" to disect the Ericsson Sy variant."
-  echo "       -d|--results-dir: directory where results are stored."
-  echo "                         By default, pcap dirname."
+  echo "       -h|--help:                this usage help."
+  echo "       -o|--other-ports <list>:  space-separated list of ports which frames"
+  echo "                                 will be decoded as diameter protocol although"
+  echo "                                 not being standard. For example, we could use"
+  echo "                                 \"13868\" to disect the Ericsson Sy variant."
+  echo "       -d|--results-dir <dir>:   directory where results are stored."
+  echo "                                 By default, pcap dirname."
+  echo "       -s|--sids <file>:         file containing a list of Session-Id values"
+  echo "                                 (one per line) to be taken into account."
+  echo "                                 If missing, all the frames will be extracted."
   echo
-  echo "       pcap:             pcap formatted file to be processed."
+  echo "       pcap:                     pcap formatted file to be processed."
   echo
   echo "       The utility, dumps the extracted hexadecimal content"
   echo "       and useful information as timestamps, source and"
@@ -73,6 +76,7 @@ usage() {
 parse_arguments() {
   OTHER_PORTS=
   RESULTS_DIR=
+  SIDS_FILE=
   PCAP_FILE=
 
   while [ $# -gt 0 ]; do
@@ -92,6 +96,11 @@ parse_arguments() {
         shift
       ;;
 
+      -s|--sids)
+        SIDS_FILE=$2
+        shift
+      ;;
+
       *)
         first=$(echo $1 | cut -c1)
         [ "$first" = "-" ] && _exit "Unsupported script option: $1. Type '$SCR_BN -h' (or --help) to print the available options."
@@ -105,6 +114,10 @@ parse_arguments() {
   [ ! -f "$PCAP_FILE" ] && _exit "Cannot found provided pcap file '$PCAP_FILE' !!"
   [ -z "$RESULTS_DIR" ] && RESULTS_DIR=`dirname $PCAP_FILE`
   [ ! -d $RESULTS_DIR ] && _exit "The results directory '$RESULTS_DIR' must exists !!"
+  if [ -n "$SIDS_FILE" ]
+  then
+    [ ! -f $SIDS_FILE ] && _exit "The Session-Id list file '$SIDS_FILE' provided, does not exist !!"
+  fi
 }
 
 _exit () {
@@ -140,8 +153,8 @@ which tshark >/dev/null
 [ $? -ne 0 ] && _exit "Missing 'tshark' tool !!"
 
 # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames):
-# Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough):
-FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.length"
+# Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): see https://www.wireshark.org/docs/dfref/d/diameter.html
+FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.length"
 FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment"
 # Disect selectors for non-standard diameter ports:
 for port in $OTHER_PORTS
@@ -152,16 +165,17 @@ done
 
 tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
 # Example output:
-#                                                                               /length\
-# frame     timestamp        src     dst   code R  App-ID   HopByHop   EndToEnd DIAM TCP          protocol                         segments 
-#   1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
-#   3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
-#   5|1427215934.456160000|gt_traf|vcbavipt|||||||1400|eth:ip:tcp:diameter|
-#   6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
-#   8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
+#                                                                                           /length\
+# frame     timestamp        src     dst   code R  App-ID   HopByHop   EndToEnd Session-Id  DIAM TCP          protocol                    segments 
+#   1           2             3       4     5   6    7         8           9       10        11  12              13                          14
+#   1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
+#   3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
+#   5|1427215934.456160000|gt_traf|vcbavipt||||||||1400|eth:ip:tcp:diameter|
+#   6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
+#   8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
 all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) )
-needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f13) )
-main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 != "") print $1 }') )
+needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f14) )
+main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($12 != "") print $1 }') )
 
 # Reassemble procedure (using frame 1 as example):
 # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself)
@@ -176,7 +190,7 @@ for frame in ${all_frames[@]}; do
   frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames)
 
   # Get the diameter part:
-  tcp_len=$(echo $frame_info | cut -d\| -f11)
+  tcp_len=$(echo $frame_info | cut -d\| -f12)
   frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }')
   cut_len=$((frm_len-2*tcp_len))
   cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex
@@ -190,11 +204,12 @@ for frame in ${all_frames[@]}; do
   code=$(echo $frame_info | cut -d\| -f5)
   isreq=$(echo $frame_info | cut -d\| -f6)
   appid=$(echo $frame_info | cut -d\| -f7)
-  hbh=$(echo $frame_info | cut -d\| -f8)
-  e2e=$(echo $frame_info | cut -d\| -f9)
-  # To decimal:
-  hbh=$(printf "%d\n" $hbh)
-  e2e=$(printf "%d\n" $e2e)
+  sid=$(echo $frame_info | cut -d\| -f10)
+  #hbh=$(echo $frame_info | cut -d\| -f8)
+  #e2e=$(echo $frame_info | cut -d\| -f9)
+  # HBH and ETE To decimal:
+  #hbh=$(printf "%d\n" $hbh)
+  #e2e=$(printf "%d\n" $e2e)
   echo "date=$date" > $RESULTS_DIR/$frame.metadata
   echo "timestamp=$ts" >> $RESULTS_DIR/$frame.metadata
   echo "src=$src" >> $RESULTS_DIR/$frame.metadata
@@ -202,9 +217,9 @@ for frame in ${all_frames[@]}; do
   echo "code=$code" >> $RESULTS_DIR/$frame.metadata
   echo "isrequest=$isreq" >> $RESULTS_DIR/$frame.metadata
   echo "applicationid=$appid" >> $RESULTS_DIR/$frame.metadata
-  #echo "sequence=${hbh}.${e2e}" >> $RESULTS_DIR/$frame.metadata
-#  echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata
-#  echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata
+  [ -n "$sid" ] && echo "sessionid=$sid" >> $RESULTS_DIR/$frame.metadata
+  #echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata
+  #echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata
 
   echo " and $RESULTS_DIR/$frame.metadata"
 done
@@ -221,9 +236,32 @@ done
 
 # Delete superfluous metadata:
 echo "Deleting superfluous buffers & metadata ..."
-segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($10 == "") print $1 }') )
+segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 == "") print $1 }') )
 for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done
 
+# Detecting Session-Id values:
+grep ^sessionid= $RESULTS_DIR/*.metadata 2>/dev/null | cut -d= -f2- | sort -u > $RESULTS_DIR/session-ids
+if [ -s $RESULTS_DIR/session-ids ]
+then
+  count=0
+  while read -r line; do count=$((count+1)) ; echo "Detected Session-Id $count: $line"; done < $RESULTS_DIR/session-ids
+  rm $RESULTS_DIR/session-ids
+fi
+
+# Purge frames with Session-Id not wanted:
+if [ -n "$SIDS_FILE" ]
+then
+  grep -l -w -f $SIDS_FILE $RESULTS_DIR/*metadata > $RESULTS_DIR/.wanted
+  grep -l ^sessionid $RESULTS_DIR/*metadata > $RESULTS_DIR/.all
+  for file in `grep -vf $RESULTS_DIR/.wanted $RESULTS_DIR/.all`
+  do
+    frm=$(basename $file | cut -d\. -f1)
+    sid=$(grep ^sessionid= $file | cut -d= -f2-)
+    echo "Purge results for frame $frm (Session-Id: '$sid') ..."
+    rm $RESULTS_DIR/${frm}.*
+  done
+  rm $RESULTS_DIR/.wanted $RESULTS_DIR/.all
+fi
 
 _exit "Done!" 0