sipzamine 0.4

安装

$ sudo apt-get install python-libpcap  # or yum install..
$ sudo pip install sipzamine

示例

一个基本示例，查找所有持续时间短于1.5秒的对话框：

$ sipzamine -m ^BYE -H ^BYE --maxdur 1.5 --pcap 'host 22.22.22.22' stored.pcap
[ 179978155f707e3622c0886752336210@22.22.22.22 ]
2011-11-23 22:27:20.746782 22.22.22.22:5060 > 123.123.123.123:5060 102 INVITE
2011-11-23 22:27:20.747508 123.123.123.123:5060 > 22.22.22.22:5060 102 INVITE(100)
2011-11-23 22:27:20.783424 123.123.123.123:5060 > 22.22.22.22:5060 102 INVITE(200)
2011-11-23 22:27:20.783956 22.22.22.22:5060 > 123.123.123.123:5060 102 ACK
2011-11-23 22:27:21.665581 22.22.22.22:5060 > 123.123.123.123:5060 103 BYE <--
2011-11-23 22:27:21.665721 123.123.123.123:5060 > 22.22.22.22:5060 103 BYE(200)

命令选项

通常使用-m通过正则表达式匹配对话框。和-p 按IP过滤。

要突出显示简明输出中的特定文本字符串，请使用-H。

基本匹配选项：

--pcap filter, -p filter
    pcap filter expression
--pmatch regex, -m regex
    any packet in dialog must match regex (can be used
    multiple times), e.g. ^INVITE to match calls
--amatch regex, -M regex
    all packets in dialog must match regex (can be used
    multiple times), e.g. ^(SIP/2.0|INVITE|BYE) to match
    calls without an ACK

输出选项：

--contents
    show complete packet contents
--dateskew seconds
    offset added to all dates, can be negative (use when
    pcap clock was off)
--highlight regex, -H regex
    highlight first matchgroup in packets (multiple
    highlights are identified by letters a..z)

特殊对话/数据包匹配选项：

--mindate date
    packets must be younger than specified date
--maxdate date
    packets must be older than specified date
--mindur seconds
    dialogs/transactions must be shorter than duration
--maxdur seconds
    dialogs/transactions must be longer than duration
--retransmits count
    at least count retransmits must be involved

待办事项

• 添加测试：从一个小的pcap开始。
• 添加从筛选器写入PCAP的功能。联合收割机能力 用小吸盘？
• 将此与sipgrep（和其他工具）进行比较？那荷马呢？

问答

如何获取pcap文件？

You’re encouraged to always write SIP pcaps on your VoIP machine. tcpdump allows you easy rotation of pcaps so you won’t run out of disk space. You can use the tcpdump247 init script if you like.