# VARIABLES #
#############
tmpdir=$(mktemp -d)
+TSHARK=tshark
#############
# FUNCTIONS #
#############
-usage () {
- echo "Usage: $0 <pcap_file> [results_dir]"
+usage() {
echo
- echo " pcap_file: pcap formatted file to be processed."
- echo " results_dir: directory where results are stored."
- echo " By default, pcap file dirname is used."
+ echo "Usage: $0 [-h|--help] [-o|--other-ports <list>] [-d|--results-dir <dir>] [-s|--sids <file>] <pcap>"
echo
- echo " The utility, dumps the extracted hexadecimal content"
- echo " and useful information as timestamps, source and"
- echo " destination:"
- echo " <results_dir>/<frame sequence>.hex"
- echo " <results_dir>/<frame sequence>.metadata"
+ echo " -h|--help: this usage help."
+ echo " -o|--other-ports <list>: space-separated list of ports which frames"
+ echo " will be decoded as diameter protocol although"
+ echo " not being standard. For example, we could use"
+ echo " \"13868\" to disect the Ericsson Sy variant."
+ echo " -d|--results-dir <dir>: directory where results are stored."
+ echo " By default, pcap dirname."
+ echo " -s|--sids <file>: file containing a list of Session-Id values"
+ echo " (one per line) to be taken into account."
+ echo " If missing, all the frames will be extracted."
+ echo
+ echo " pcap: pcap formatted file to be processed."
+ echo
+ echo " The utility, dumps the extracted hexadecimal content and useful information"
+ echo " (timestamps, source, destination, etc.) within a metadata file:"
+ echo
+ echo " <results directory>/<frame sequence>.hex"
+ echo " <results directory>/<frame sequence>.metadata"
echo
_exit
}
+parse_arguments() {
+ OTHER_PORTS=
+ RESULTS_DIR=
+ SIDS_FILE=
+ PCAP_FILE=
+
+ while [ $# -gt 0 ]; do
+ case $1 in
+ -h|--help)
+ usage
+ ;;
+
+ -o|--other-ports)
+ OTHER_PORTS="$2"
+ [ -z "$OTHER_PORTS" ] && _exit "Missing non-standard ports list"
+ shift
+ ;;
+
+ -d|--results-dir)
+ RESULTS_DIR=$2
+ shift
+ ;;
+
+ -s|--sids)
+ SIDS_FILE=$2
+ shift
+ ;;
+
+ *)
+ first=$(echo $1 | cut -c1)
+ [ "$first" = "-" ] && _exit "Unsupported script option: $1. Type '$SCR_BN -h' (or --help) to print the available options."
+ PCAP_FILE=$1
+ ;;
+ esac
+ shift
+ done
+
+ [ -z "$PCAP_FILE" ] && _exit "Missing pcap file"
+ [ ! -f "$PCAP_FILE" ] && _exit "Cannot found provided pcap file '$PCAP_FILE' !!"
+ [ -z "$RESULTS_DIR" ] && RESULTS_DIR=`dirname $PCAP_FILE`
+ [ ! -d $RESULTS_DIR ] && _exit "The results directory '$RESULTS_DIR' must exists !!"
+ if [ -n "$SIDS_FILE" ]
+ then
+ [ ! -f $SIDS_FILE ] && _exit "The Session-Id list file '$SIDS_FILE' provided, does not exist !!"
+ fi
+}
+
_exit () {
echo
echo -e $1
echo "============================================"
echo
-# Usage:
-[ "$1" = "" ] && usage
-
-# Pcap file:
-PCAP_FILE=$1
-[ ! -f $PCAP_FILE ] && _exit "Cannot found provided pcap file '$1' !!"
+# Arguments:
+[ "$1" = "" -o "$1" = "--help" -o "$1" = "-h" ] && usage
+parse_arguments "$@"
# Tshark available:
-which tshark >/dev/null
+which $TSHARK >/dev/null 2>/dev/null
[ $? -ne 0 ] && _exit "Missing 'tshark' tool !!"
-# Optional result dir:
-RESULTS_DIR=`dirname $PCAP_FILE`
-[ "$2" != "" ] && RESULTS_DIR=$2
-[ ! -d $RESULTS_DIR ] && _exit "The results directory '$RESULTS_DIR' must exists !!"
-
# Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames):
-# Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough):
-FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.length"
+# Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): see https://www.wireshark.org/docs/dfref/d/diameter.html
+FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.Origin-Host -e diameter.Subscription-Id-Data -e diameter.Subscription-Id-Type -e diameter.length"
FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment"
-# Disect selectors
-# 13868 port for Ericsson Sy
-DISECT_SELECTORS="-d tcp.port=13868,diameter"
+# Disect selectors for non-standard diameter ports:
+for port in $OTHER_PORTS
+do
+ echo "Taking tcp port $port to be decoded as diameter protocol"
+ DISECT_SELECTORS="$DISECT_SELECTORS -d tcp.port=$port,diameter"
+done
-tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
+$TSHARK -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames
# Example output:
-# /length\
-# frame timestamp src dst code R App-ID HopByHop EndToEnd DIAM TCP protocol segments
-# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
-# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
-# 5|1427215934.456160000|gt_traf|vcbavipt|||||||1400|eth:ip:tcp:diameter|
-# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
-# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# /length\
+# frame timestamp src dst code R App-ID HopByHop EndToEnd Session-Id Origin-Host Subs-Data Subs-Type DIAM TCP protocol segments
+# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
+# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp|
+# 5|1427215934.456160000|gt_traf|vcbavipt||||||||1400|eth:ip:tcp:diameter|
+# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6
+# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp|
all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) )
-needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f13) )
-main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 != "") print $1 }') )
+needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f17) )
+main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($15 != "") print $1 }') )
# Reassemble procedure (using frame 1 as example):
# (for non segmented frames, it is enough with tcp or diameter length within the frame content itself)
frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames)
# Get the diameter part:
- tcp_len=$(echo $frame_info | cut -d\| -f11)
+ tcp_len=$(echo $frame_info | cut -d\| -f15)
frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }')
cut_len=$((frm_len-2*tcp_len))
cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex
code=$(echo $frame_info | cut -d\| -f5)
isreq=$(echo $frame_info | cut -d\| -f6)
appid=$(echo $frame_info | cut -d\| -f7)
- hbh=$(echo $frame_info | cut -d\| -f8)
- e2e=$(echo $frame_info | cut -d\| -f9)
- # To decimal:
- hbh=$(printf "%d\n" $hbh)
- e2e=$(printf "%d\n" $e2e)
+ sid=$(echo $frame_info | cut -d\| -f10)
+ oh=$(echo $frame_info | cut -d\| -f11)
+ subscriber=$(echo $frame_info | cut -d\| -f12)
+ subscribertype=$(echo $frame_info | cut -d\| -f13)
+ [ "$subscribertype" = "0" ] && subscribertype=msisdn
+ [ "$subscribertype" = "1" ] && subscribertype=imsi
+
+ #hbh=$(echo $frame_info | cut -d\| -f8)
+ #e2e=$(echo $frame_info | cut -d\| -f9)
+ # HBH and ETE To decimal:
+ #hbh=$(printf "%d\n" $hbh)
+ #e2e=$(printf "%d\n" $e2e)
echo "date=$date" > $RESULTS_DIR/$frame.metadata
echo "timestamp=$ts" >> $RESULTS_DIR/$frame.metadata
echo "src=$src" >> $RESULTS_DIR/$frame.metadata
echo "code=$code" >> $RESULTS_DIR/$frame.metadata
echo "isrequest=$isreq" >> $RESULTS_DIR/$frame.metadata
echo "applicationid=$appid" >> $RESULTS_DIR/$frame.metadata
- #echo "sequence=${hbh}.${e2e}" >> $RESULTS_DIR/$frame.metadata
-# echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata
-# echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata
+ [ -n "$sid" ] && echo "sessionid=$sid" >> $RESULTS_DIR/$frame.metadata
+ echo "originhost=$oh" >> $RESULTS_DIR/$frame.metadata
+ if [ -n "$subscriber" ]
+ then
+ echo "subscriber=$subscriber" >> $RESULTS_DIR/$frame.metadata
+ echo "subscribertype=$subscribertype" >> $RESULTS_DIR/$frame.metadata
+ fi
+ #echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata
+ #echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata
echo " and $RESULTS_DIR/$frame.metadata"
done
# Delete superfluous metadata:
echo "Deleting superfluous buffers & metadata ..."
-segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($10 == "") print $1 }') )
+segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($14 == "") print $1 }') )
for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done
+# Detecting Session-Id values:
+grep ^sessionid= $RESULTS_DIR/*.metadata 2>/dev/null | cut -d= -f2- | sort -u > $RESULTS_DIR/session-ids
+if [ -s $RESULTS_DIR/session-ids ]
+then
+ count=0
+ while read -r line; do count=$((count+1)) ; echo "Detected Session-Id $count: $line"; done < $RESULTS_DIR/session-ids
+ rm $RESULTS_DIR/session-ids
+fi
+
+# Detecting Origin-Host values:
+grep ^originhost= $RESULTS_DIR/*.metadata 2>/dev/null | cut -d= -f2- | sort -u > $RESULTS_DIR/origin-hosts
+if [ -s $RESULTS_DIR/origin-hosts ]
+then
+ count=0
+ while read -r line; do count=$((count+1)) ; echo "Detected Origin-Host $count: $line"; done < $RESULTS_DIR/origin-hosts
+ #rm $RESULTS_DIR/origin-hosts
+fi
+
+# Purge frames with Session-Id not wanted:
+if [ -n "$SIDS_FILE" ]
+then
+ grep -l -w -f $SIDS_FILE $RESULTS_DIR/*metadata > $RESULTS_DIR/.wanted
+ grep -l ^sessionid $RESULTS_DIR/*metadata > $RESULTS_DIR/.all
+ for file in `grep -vf $RESULTS_DIR/.wanted $RESULTS_DIR/.all`
+ do
+ frm=$(basename $file | cut -d\. -f1)
+ sid=$(grep ^sessionid= $file | cut -d= -f2-)
+ echo "Purge results for frame $frm (Session-Id: '$sid') ..."
+ rm $RESULTS_DIR/${frm}.*
+ done
+ rm $RESULTS_DIR/.wanted $RESULTS_DIR/.all
+fi
_exit "Done!" 0
projects / anna.git / blobdiff