X-Git-Url: https://git.teslayout.com/public/public/public/?p=anna.git;a=blobdiff_plain;f=example%2Fdiameter%2FpcapDecoder%2FtsharkDecoder.sh;h=c290e1754d809ae089ff644cef58decc8f0515b1;hp=deca8eb877ffcb5e5bfac6bc2ea4b5a73e5edc09;hb=77105a89de724b0bc5b4b9c9f2844cb44db1de3e;hpb=d707222ededa671375bbf30d531dd97d064bd985 diff --git a/example/diameter/pcapDecoder/tsharkDecoder.sh b/example/diameter/pcapDecoder/tsharkDecoder.sh index deca8eb..c290e17 100755 --- a/example/diameter/pcapDecoder/tsharkDecoder.sh +++ b/example/diameter/pcapDecoder/tsharkDecoder.sh @@ -42,6 +42,7 @@ # VARIABLES # ############# tmpdir=$(mktemp -d) +TSHARK=tshark ############# # FUNCTIONS # @@ -64,9 +65,9 @@ usage() { echo echo " pcap: pcap formatted file to be processed." echo - echo " The utility, dumps the extracted hexadecimal content" - echo " and useful information as timestamps, source and" - echo " destination:" + echo " The utility, dumps the extracted hexadecimal content and useful information" + echo " (timestamps, source, destination, etc.) within a metadata file:" + echo echo " /.hex" echo " /.metadata" echo @@ -149,12 +150,12 @@ echo parse_arguments "$@" # Tshark available: -which tshark >/dev/null +which $TSHARK >/dev/null 2>/dev/null [ $? -ne 0 ] && _exit "Missing 'tshark' tool !!" # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): see https://www.wireshark.org/docs/dfref/d/diameter.html -FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.length" +FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.Origin-Host -e diameter.length" FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment" # Disect selectors for non-standard diameter ports: for port in $OTHER_PORTS @@ -163,19 +164,19 @@ do DISECT_SELECTORS="$DISECT_SELECTORS -d tcp.port=$port,diameter" done -tshark -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames +$TSHARK -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: -# /length\ -# frame timestamp src dst code R App-ID HopByHop EndToEnd Session-Id DIAM TCP protocol segments -# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 -# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# /length\ +# frame timestamp src dst code R App-ID HopByHop EndToEnd Session-Id Origin-Host DIAM TCP protocol segments +# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 +# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| # 5|1427215934.456160000|gt_traf|vcbavipt||||||||1400|eth:ip:tcp:diameter| -# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 -# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f14) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($12 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f15) ) +main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($13 != "") print $1 }') ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -190,7 +191,7 @@ for frame in ${all_frames[@]}; do frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) # Get the diameter part: - tcp_len=$(echo $frame_info | cut -d\| -f12) + tcp_len=$(echo $frame_info | cut -d\| -f13) frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') cut_len=$((frm_len-2*tcp_len)) cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex @@ -205,6 +206,7 @@ for frame in ${all_frames[@]}; do isreq=$(echo $frame_info | cut -d\| -f6) appid=$(echo $frame_info | cut -d\| -f7) sid=$(echo $frame_info | cut -d\| -f10) + oh=$(echo $frame_info | cut -d\| -f11) #hbh=$(echo $frame_info | cut -d\| -f8) #e2e=$(echo $frame_info | cut -d\| -f9) # HBH and ETE To decimal: @@ -218,6 +220,7 @@ for frame in ${all_frames[@]}; do echo "isrequest=$isreq" >> $RESULTS_DIR/$frame.metadata echo "applicationid=$appid" >> $RESULTS_DIR/$frame.metadata [ -n "$sid" ] && echo "sessionid=$sid" >> $RESULTS_DIR/$frame.metadata + echo "originhost=$oh" >> $RESULTS_DIR/$frame.metadata #echo "hopbyhop=$hbh" >> $RESULTS_DIR/$frame.metadata #echo "endtoend=$e2e" >> $RESULTS_DIR/$frame.metadata @@ -236,7 +239,7 @@ done # Delete superfluous metadata: echo "Deleting superfluous buffers & metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($11 == "") print $1 }') ) +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($12 == "") print $1 }') ) for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done # Detecting Session-Id values: @@ -244,10 +247,19 @@ grep ^sessionid= $RESULTS_DIR/*.metadata 2>/dev/null | cut -d= -f2- | sort -u > if [ -s $RESULTS_DIR/session-ids ] then count=0 - while read -r line; do count=$((count+1)) ; echo "Detected Session-Id $count: $line"; done < $RESULTS_DIR/session-ids + while read -r line; do count=$((count+1)) ; echo "Detected Session-Id $count: $line"; done < $RESULTS_DIR/session-ids rm $RESULTS_DIR/session-ids fi +# Detecting Origin-Host values: +grep ^originhost= $RESULTS_DIR/*.metadata 2>/dev/null | cut -d= -f2- | sort -u > $RESULTS_DIR/origin-hosts +if [ -s $RESULTS_DIR/origin-hosts ] +then + count=0 + while read -r line; do count=$((count+1)) ; echo "Detected Origin-Host $count: $line"; done < $RESULTS_DIR/origin-hosts + #rm $RESULTS_DIR/origin-hosts +fi + # Purge frames with Session-Id not wanted: if [ -n "$SIDS_FILE" ] then