Skip to main content

SIP dialog examine utility (formerly sipcaparseye)

Project description

Command line SIP dialog matching and searching through offline PCAPs.

pypi_version

Installing

$ sudo apt-get install python-libpcap  # or yum install..
$ sudo pip install sipzamine

Example

A basic example, finding all dialogs that last shorter than 1.5 seconds:

$ sipzamine -m ^BYE -H ^BYE --maxdur 1.5 --pcap 'host 22.22.22.22' stored.pcap
[ 179978155f707e3622c0886752336210@22.22.22.22 ]
2011-11-23 22:27:20.746782 22.22.22.22:5060 > 123.123.123.123:5060 102 INVITE
2011-11-23 22:27:20.747508 123.123.123.123:5060 > 22.22.22.22:5060 102 INVITE(100)
2011-11-23 22:27:20.783424 123.123.123.123:5060 > 22.22.22.22:5060 102 INVITE(200)
2011-11-23 22:27:20.783956 22.22.22.22:5060 > 123.123.123.123:5060 102 ACK
2011-11-23 22:27:21.665581 22.22.22.22:5060 > 123.123.123.123:5060 103 BYE <--
2011-11-23 22:27:21.665721 123.123.123.123:5060 > 22.22.22.22:5060 103 BYE(200)

Command options

Normally you use -m to match a dialog by regular expression. And -p to filter by IP.

To highlight a particular text string in the concise output, use -H.

Basic matching options:

--pcap filter, -p filter
    pcap filter expression
--pmatch regex, -m regex
    any packet in dialog must match regex (can be used
    multiple times), e.g. ^INVITE to match calls
--amatch regex, -M regex
    all packets in dialog must match regex (can be used
    multiple times), e.g. ^(SIP/2.0|INVITE|BYE) to match
    calls without an ACK

Output options:

--contents
    show complete packet contents
--dateskew seconds
    offset added to all dates, can be negative (use when
    pcap clock was off)
--highlight regex, -H regex
    highlight first matchgroup in packets (multiple
    highlights are identified by letters a..z)

Special dialog/packet matching options:

--mindate date
    packets must be younger than specified date
--maxdate date
    packets must be older than specified date
--mindur seconds
    dialogs/transactions must be shorter than duration
--maxdur seconds
    dialogs/transactions must be longer than duration
--retransmits count
    at least count retransmits must be involved

TODO

  • Add tests: begin with a smallish pcap.

  • Add the ability to write pcaps from the filter. Combine capability with sipscrub?

  • Compare this to sipgrep (and other tools?). And homer?

Q & A

How do I get pcap files?

You’re encouraged to always write SIP pcaps on your VoIP machine. tcpdump allows you easy rotation of pcaps so you won’t run out of disk space. You can use the tcpdump247 init script if you like.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sipzamine-0.7.tar.gz (45.1 kB view hashes)

Uploaded Source

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page