Basically, you are trying to build what Empirix has with their Hammer tool.
You can create an application that is basically a mix of tshark and a database feeder.
You sniff with tshark and going to basically pipe it to another application that will read the pcap file, parse it, and load it into the db for you. There are plenty of modules out there that will read pcap for you.
On Fri, Feb 20, 2009 at 11:15 AM, kokoska rokoska
<kokoska.rokoska@post.cz> wrote:
jonathan augenstine napsal(a):
> You can tcpdump and then use wireshark to graph the calls. When the
> dump is displayed in wireshark, select 'Statistics' -> VoIP Calls. You
> will see a display of all VoIP calls. Select the one you want graphed,
> or select them all and you will see REINVITE and REFER interaction as
> well as RTP streams.
>
Thank you very much, jonathan, for your interest!
I use ngrep+wireshark many times a day, but I'm affraid it is not
suitable for that amount of data.
Even with few hundreds MiBs of pcap file wireshark becoms very slow and
I can't imagine how to load 50-100 GiB file with milions of calls and
try to search for one of them :-)
And, even worse, I should "rotate" the file and, don't end with call
divided to multiple files...