3 # ANNA - Anna is Not Nothingness Anymore
5 # (c) Copyright 2005-2014 Eduardo Ramos Testillano & Francisco Ruiz Rayo
7 # http://redmine.teslayout.com/projects/anna-suite
9 # Redistribution and use in source and binary forms, with or without
10 # modification, are permitted provided that the following conditions
13 # * Redistributions of source code must retain the above copyright
14 # notice, this list of conditions and the following disclaimer.
15 # * Redistributions in binary form must reproduce the above
16 # copyright notice, this list of conditions and the following disclaimer
17 # in the documentation and/or other materials provided with the
19 # * Neither the name of the copyright holder nor the names of its
20 # contributors may be used to endorse or promote products derived from
21 # this software without specific prior written permission.
23 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 # OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
29 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
30 # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
31 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
32 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
33 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 # Authors: eduardo.ramos.testillano@gmail.com
36 # cisco.tierra@gmail.com
39 # Decoder version using tshark tool
51 echo "Usage: $0 <pcap_file> [results_dir]"
53 echo " pcap_file: pcap formatted file to be processed."
54 echo " results_dir: directory where results are stored."
55 echo " By default, pcap file dirname is used."
57 echo " The utility, dumps the extracted hexadecimal content"
58 echo " and useful information as timestamps, source and"
60 echo " <results_dir>/<frame sequence>.hex"
61 echo " <results_dir>/<frame sequence>.metadata"
85 echo "============================================"
86 echo "Diameter buffer extractor from PCAP raw file"
87 echo "============================================"
91 [ "$1" = "" ] && usage
95 [ ! -f $PCAP_FILE ] && _exit "Cannot found provided pcap file '$1' !!"
98 which tshark >/dev/null
99 [ $? -ne 0 ] && _exit "Missing 'tshark' tool !!"
101 # Optional result dir:
102 RESULTS_DIR=`dirname $PCAP_FILE`
103 [ "$2" != "" ] && RESULTS_DIR=$2
104 [ ! -d $RESULTS_DIR ] && _exit "The results directory '$RESULTS_DIR' must exists !!"
106 # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames):
107 # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough):
108 FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.length"
109 FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment"
110 # Disect selectors for non-standard diameter ports:
111 # 13868 port for Ericsson Sy
112 DISECT_SELECTORS="-d tcp.port=13868,diameter"
114 tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
117 # frame timestamp src dst code R App-ID HopByHop EndToEnd DIAM TCP protocol segments
118 # 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
119 # 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
120 # 5|1427215934.456160000|gt_traf|vcbavipt|||||||1400|eth:ip:tcp:diameter|
121 # 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
122 # 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
123 all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) )
124 needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f13) )
125 main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 != "") print $1 }') )
127 # Reassemble procedure (using frame 1 as example):
128 # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself)
129 # 1) Get the TCP length: 432 bytes. 432*2 = 864 characters per byte in hexadecimal string format
130 # 2) Get the frame length: `wc -c $tmpdir/block.$frame` => 997
131 # 3) Get 864 from the tail: `cat $tmpdir/block.$frame | cut -c133
133 # Dump the hex blocks for all the diameter frames:
134 cat $PCAP_FILE | rawshark -s -r - -d proto:diameter -F data 2>/dev/null > $tmpdir/all_hex_data
135 for frame in ${all_frames[@]}; do
136 grep "^$frame " $tmpdir/all_hex_data | cut -d\" -f2 | sed 's/://g' > $tmpdir/block.$frame
137 frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames)
139 # Get the diameter part:
140 tcp_len=$(echo $frame_info | cut -d\| -f11)
141 frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }')
142 cut_len=$((frm_len-2*tcp_len))
143 cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex
144 echo -n "Created $RESULTS_DIR/$frame.hex"
147 ts=$(echo $frame_info | cut -d\| -f2)
149 src=$(echo $frame_info | cut -d\| -f3)
150 dst=$(echo $frame_info | cut -d\| -f4)
151 code=$(echo $frame_info | cut -d\| -f5)
152 isreq=$(echo $frame_info | cut -d\| -f6)
153 appid=$(echo $frame_info | cut -d\| -f7)
154 hbh=$(echo $frame_info | cut -d\| -f8)
155 e2e=$(echo $frame_info | cut -d\| -f9)
157 hbh=$(printf "%d\n" $hbh)
158 e2e=$(printf "%d\n" $e2e)
159 echo "date=$date" > $RESULTS_DIR/$frame.metadata
160 echo "timestamp=$ts" >> $RESULTS_DIR/$frame.metadata
161 echo "src=$src" >> $RESULTS_DIR/$frame.metadata
162 echo "dst=$dst" >> $RESULTS_DIR/$frame.metadata
163 echo "code=$code" >> $RESULTS_DIR/$frame.metadata
164 echo "isrequest=$isreq" >> $RESULTS_DIR/$frame.metadata
165 echo "applicationid=$appid" >> $RESULTS_DIR/$frame.metadata
166 #echo "sequence=${hbh}.${e2e}" >> $RESULTS_DIR/$frame.metadata
167 # echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata
168 # echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata
170 echo " and $RESULTS_DIR/$frame.metadata"
173 # Join frames which need to be reassembled:
174 for group in ${needs_join[@]}; do
175 echo "Grouping frames $group ..."
176 group_array=( $(echo $group | sed 's/,/ /g') )
177 for frame in ${group_array[@]}; do
178 cat $RESULTS_DIR/$frame.hex >> $tmpdir/diam.$group
180 cat $tmpdir/diam.$group | tr -d '\n' > $RESULTS_DIR/$frame.hex
183 # Delete superfluous metadata:
184 echo "Deleting superfluous buffers & metadata ..."
185 segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($10 == "") print $1 }') )
186 for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done