From fb8aa8a6a7f3f241c2f7d4db8c2b1893335511b6 Mon Sep 17 00:00:00 2001 From: Eduardo Ramos Testillano Date: Fri, 10 Apr 2015 14:50:48 +0200 Subject: [PATCH] Add application id to metadata --- .../launcher/resources/pcap2diameterHex.sh | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/example/diameter/launcher/resources/pcap2diameterHex.sh b/example/diameter/launcher/resources/pcap2diameterHex.sh index f5150b0..996b18f 100755 --- a/example/diameter/launcher/resources/pcap2diameterHex.sh +++ b/example/diameter/launcher/resources/pcap2diameterHex.sh @@ -99,19 +99,25 @@ RESULTS_DIR=`dirname $PCAP_FILE` # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): -FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" +FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.applicationId -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: # /length\ -# frame timestamp src dst TCP DIAM protocol segments +# frame timestamp src dst App-ID TCP DIAM protocol segments +# 1|1427215933.697904000|gt_traf|vcbavipt|16777238|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|1427215934.449523000|vcbavipt|gt_traf|16777238|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 5|1427215934.456160000|gt_traf|vcbavipt||1400||eth:ip:tcp:diameter| +# 6|1427215934.456204000|gt_traf|vcbavipt|16777236|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|1427215935.123559000|vcbavipt|gt_traf|16777236|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| + # 1|1427215933.697904000|gt_traf|vcbavipt|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| # 3|1427215934.449523000|vcbavipt|gt_traf|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| # 5|1427215934.456160000|gt_traf|vcbavipt|1400||eth:ip:tcp:diameter| # 6|1427215934.456204000|gt_traf|vcbavipt|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 # 8|1427215935.123559000|vcbavipt|gt_traf|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f8) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f9) ) +main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($7 != "") print $1 }') ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -126,7 +132,7 @@ for frame in ${all_frames[@]}; do frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) # Get the diameter part: - tcp_len=$(echo $frame_info | cut -d\| -f5) + tcp_len=$(echo $frame_info | cut -d\| -f6) frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') cut_len=$((frm_len-2*tcp_len)) cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex @@ -137,7 +143,8 @@ for frame in ${all_frames[@]}; do date=$(date -d @$ts) src=$(echo $frame_info | cut -d\| -f3) dst=$(echo $frame_info | cut -d\| -f4) - echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst" > $RESULTS_DIR/$frame.metadata + appid=$(echo $frame_info | cut -d\| -f5) + echo -e "timestamp=$ts\ndate=$date\nsrc=$src\ndst=$dst\napplicationid=$appid" > $RESULTS_DIR/$frame.metadata echo " and $RESULTS_DIR/$frame.metadata" done @@ -153,7 +160,7 @@ done # Delete superfluous metadata: echo "Deleting superfluous buffers & metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($6 == "") print $1 }') ) +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($7 == "") print $1 }') ) for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done -- 2.20.1