From 7f71fdb0169af46406b875014b6fc297475cff62 Mon Sep 17 00:00:00 2001 From: Eduardo Ramos Testillano Date: Thu, 3 Mar 2016 16:20:46 +0100 Subject: [PATCH] Support for SCTP transport on tshark decoding --- example/diameter/pcapDecoder/tsharkDecoder.sh | 55 +++++++++++++------ 1 file changed, 39 insertions(+), 16 deletions(-) diff --git a/example/diameter/pcapDecoder/tsharkDecoder.sh b/example/diameter/pcapDecoder/tsharkDecoder.sh index 64ff2af..fbb6bb5 100755 --- a/example/diameter/pcapDecoder/tsharkDecoder.sh +++ b/example/diameter/pcapDecoder/tsharkDecoder.sh @@ -157,8 +157,7 @@ which $TSHARK >/dev/null 2>/dev/null # Get the frames with diameter content (take care about '-2' two-pass option and don't add it, because we need to get reassembled parts in their corresponding frames): # Fields needed (we won't need diameter.hopbyhopid & diameter.endtoendid to verify diameter message as hint patterns; length management will be enough): see https://www.wireshark.org/docs/dfref/d/diameter.html -FIELDS_DIAMETER="-e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.Origin-Host -e diameter.Subscription-Id-Data -e diameter.Subscription-Id-Type -e diameter.length" -FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host $FIELDS_DIAMETER -e tcp.len -e frame.protocols -e tcp.segment" +FIELDS="-e frame.number -e frame.time_epoch -e ip.src_host -e ip.dst_host -e diameter.cmd.code -e diameter.flags.request -e diameter.applicationId -e diameter.hopbyhopid -e diameter.endtoendid -e diameter.Session-Id -e diameter.Origin-Host -e diameter.Subscription-Id-Data -e diameter.Subscription-Id-Type -e frame.len -e tcp.len -e diameter.length -e frame.protocols -e tcp.segment" # Disect selectors for non-standard diameter ports: for port in $OTHER_PORTS do @@ -168,17 +167,16 @@ done $TSHARK -E separator="|" -r $PCAP_FILE -N mntC -Tfields $FIELDS $DISECT_SELECTORS 2>/dev/null | grep -i diameter > $tmpdir/diameter_frames # Example output: -# /length\ -# frame timestamp src dst code R App-ID HopByHop EndToEnd Session-Id Origin-Host Subs-Data Subs-Type DIAM TCP protocol segments -# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 -# 1|1427215933.697904000|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 3|1427215934.449523000|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| -# 5|1427215934.456160000|gt_traf|vcbavipt||||||||1400|eth:ip:tcp:diameter| -# 6|1427215934.456204000|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|1972|572|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 -# 8|1427215935.123559000|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxxxxxx|xxxxxxxxxxxxx|xxxxxxxxxx|xxxxxxxxxxx|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| +# / lengths \ +# frm timestamp src dst code R App-ID HopByHop EndToEnd Sid OHost Subs SubsType FRM TCP DIA protocol segments +# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 +# 1|tt.tt|gt_traf|vcbavipt|272|1|16777238|0x0004e6e6|0x000bd986|xxx|xxxxx|xxxxx|xxxxxxx|fff|432|432|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 3|tt.tt|vcbavipt|gt_traf|272|0|16777238|0x0004e6e6|0x000bd986|xxx|xxxxx|xxxxx|xxxxxxx|fff|292|292|eth:ip:tcp:diameter:diameter:diameter3gpp| +# 5|tt.tt|gt_traf|vcbavipt||||||ffff|1400||eth:ip:tcp:diameter| +# 6|tt.tt|gt_traf|vcbavipt|265|1|16777236|0x000c73c3|0x0004cee4|xxx|xxxxx|xxxxx|xxxxxxx|fff|572|1972|eth:ip:tcp:diameter:diameter:diameter3gpp|5,6 +# 8|tt.tt|vcbavipt|gt_traf|265|0|16777236|0x000c73c3|0x0004cee4|xxx|xxxxx|xxxxx|xxxxxxx|fff|248|248|eth:ip:tcp:diameter:diameter:diameter3gpp| all_frames=( $(cat $tmpdir/diameter_frames | cut -d\| -f1) ) -needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f17) ) -main_frames=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($15 != "") print $1 }') ) +needs_join=( $(cat $tmpdir/diameter_frames | cut -d\| -f18) ) # Reassemble procedure (using frame 1 as example): # (for non segmented frames, it is enough with tcp or diameter length within the frame content itself) @@ -192,11 +190,35 @@ for frame in ${all_frames[@]}; do grep "^$frame " $tmpdir/all_hex_data | cut -d\" -f2 | sed 's/://g' > $tmpdir/block.$frame frame_info=$(grep "^${frame}|" $tmpdir/diameter_frames) + ########################################################################################## # Get the diameter part: + frm_len=$(echo $frame_info | cut -d\| -f14) tcp_len=$(echo $frame_info | cut -d\| -f15) - frm_len=$(wc -c $tmpdir/block.$frame | awk '{ print $1 }') - cut_len=$((frm_len-2*tcp_len)) - cat $tmpdir/block.$frame | cut -c${cut_len}- > $RESULTS_DIR/$frame.hex + dia_len=$(echo $frame_info | cut -d\| -f16) + protocol=$(echo $frame_info | cut -d\| -f17) + + # TCP and SCTP supported: + transport=$(echo $protocol | grep -ow tcp) + [ -z "$transport" ] && transport=$(echo $protocol | grep -ow sctp) + + case $transport in + sctp) + cut_len=$((2*dia_len)) + cat $tmpdir/block.$frame | rev | cut -c-${cut_len} | rev > $RESULTS_DIR/$frame.hex + ;; + + tcp) + cut_len=$((frm_len-tcp_len)) + defi=$((2*cut_len + 1)) + cat $tmpdir/block.$frame | cut -c${defi}- > $RESULTS_DIR/$frame.hex + cp $tmpdir/block.$frame /tmp/block + ;; + + *) _exit "Only TCP and SCTP transports supported !!" + ;; + esac + ########################################################################################## + echo -n "Created $RESULTS_DIR/$frame.hex" # Metadata: @@ -214,6 +236,7 @@ for frame in ${all_frames[@]}; do [ "$subscribertype" = "0" ] && subscribertype=msisdn [ "$subscribertype" = "1" ] && subscribertype=imsi + #hbh=$(echo $frame_info | cut -d\| -f8) #e2e=$(echo $frame_info | cut -d\| -f9) # HBH and ETE To decimal: @@ -251,7 +274,7 @@ done # Delete superfluous metadata: echo "Deleting superfluous buffers & metadata ..." -segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($14 == "") print $1 }') ) +segments=( $(cat $tmpdir/diameter_frames | awk -F\| '{ if ($16 == "") print $1 }') ) for s in ${segments[@]}; do rm $RESULTS_DIR/$s.*; done # Detecting Session-Id values: -- 2.20.1