From: Eduardo Ramos Testillano Date: Fri, 10 Apr 2015 13:36:52 +0000 (+0200) Subject: Now adds is request flag X-Git-Tag: REFACTORING_TESTING_LIBRARY~170 X-Git-Url: https://git.teslayout.com/public/public/public/?a=commitdiff_plain;h=328017ac2fa79957c519789a9b6a9a290f5b4b8f;p=anna.git Now adds is request flag --- diff --git a/example/diameter/launcher/resources/pcap2diameterHex.sh b/example/diameter/launcher/resources/pcap2diameterHex.sh index b843db3..07c0982 100755 --- a/example/diameter/launcher/resources/pcap2diameterHex.sh +++ b/example/diameter/launcher/resources/pcap2diameterHex.sh @@ -99,19 +99,19 @@ RESULTS_DIR=`dirname $PCAP_FILE` # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): -FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" +FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.flags.request -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: # /length\ -# frame timestamp src dst App-ID TCP DIAM protocol segments -# 1|1427215933.697904000|gt_traf|vcbavipt|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 3|1427215934.449523000|vcbavipt|gt_traf|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 5|1427215934.456160000|gt_traf|vcbavipt||1400||eth:ip:tcp:diameter| -# 6|1427215934.456204000|gt_traf|vcbavipt|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 -# 8|1427215935.123559000|vcbavipt|gt_traf|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| +# frame timestamp src dst R App-ID TCP DIAM protocol segments +# 1|1427215933.697904000|gt_traf|vcbavipt|1|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|1427215934.449523000|vcbavipt|gt_traf|0|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 5|1427215934.456160000|gt_traf|vcbavipt|||1400||eth:ip:tcp:diameter| +# 6|1427215934.456204000|gt_traf|vcbavipt|1|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|1427215935.123559000|vcbavipt|gt_traf|0|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f9) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($7 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f10) ) +main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if (8 != "") print $1 }') ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -126,7 +126,7 @@ for frame in ${all_frames[@]}; do frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) # Get the diameter part: - tcp_len=$(echo $frame_info | cut -d\| -f6) + tcp_len=$(echo $frame_info | cut -d\| -f7) frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') cut_len=$((frm_len-2*tcp_len)) cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex @@ -137,8 +137,9 @@ for frame in ${all_frames[@]}; do date=$(date -d @$ts) src=$(echo $frame_info | cut -d\| -f3) dst=$(echo $frame_info | cut -d\| -f4) - appid=$(echo $frame_info | cut -d\| -f5) - echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata + isreq=$(echo $frame_info | cut -d\| -f5) + appid=$(echo $frame_info | cut -d\| -f6) + echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\nisrequest=$isreq\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata echo " and $RESULTS_DIR/$frame.metadata" done @@ -154,7 +155,7 @@ done # Delete superfluous metadata: echo "Deleting superfluous buffers & metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($7 == "") print $1 }') ) +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($8 == "") print $1 }') ) for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done