Hey Folks, I'm curious to know tools you guys use at the Linux command line. I'm finding that I have many pcap files with SIP/RTP in them and slurping them over to a laptop w/ Wireshark is frequently cumbersome. My ideal tool here is something that prints out a ladder diagram or even a quick and dirty report on the SIP dialog(s). I would have to say that the closest thing I've found so far is Alexandr Dubovikov's awesome Sipgrep2. I'd like to hear about some of your favorite tools and tricks. -MC
ngrep is great for seeing the SIP packets: ngrep -qt -W byline -I /path/to/file.pcap On 4 February 2015 at 21:20, Michael Collins <msc@freeswitch.org> wrote:
Hey Folks,
I'm curious to know tools you guys use at the Linux command line. I'm finding that I have many pcap files with SIP/RTP in them and slurping them over to a laptop w/ Wireshark is frequently cumbersome.
My ideal tool here is something that prints out a ladder diagram or even a quick and dirty report on the SIP dialog(s). I would have to say that the closest thing I've found so far is Alexandr Dubovikov's awesome Sipgrep2.
I'd like to hear about some of your favorite tools and tricks.
-MC
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Wed, Feb 4, 2015 at 2:00 PM, Peter <freeswitch@pbaines.com> wrote:
ngrep is great for seeing the SIP packets:
ngrep -qt -W byline -I /path/to/file.pcap
Indeed it is. I use it see specific parts of the dialog, like if I want to see just INVITES: ngreqp -qt 'INVITE sip:' -W byline port 5060 Any others? -MC
FYI, I somehow stumbled across this: https://github.com/irontec/sngrep It actually works really well and it perfect for what I need. After I get some experience with it I will add it to the wiki. -MC On Wed, Feb 4, 2015 at 2:19 PM, Michael Collins <msc@freeswitch.org> wrote:
On Wed, Feb 4, 2015 at 2:00 PM, Peter <freeswitch@pbaines.com> wrote:
ngrep is great for seeing the SIP packets:
ngrep -qt -W byline -I /path/to/file.pcap
Indeed it is. I use it see specific parts of the dialog, like if I want to see just INVITES:
ngreqp -qt 'INVITE sip:' -W byline port 5060
Any others? -MC
Hi Michael, On 4 February 2015 at 15:01, Michael Collins <msc@freeswitch.org> wrote:
FYI,
I somehow stumbled across this: https://github.com/irontec/sngrep
It actually works really well and it perfect for what I need. After I get some experience with it I will add it to the wiki.
Looking forward to your write up! By the way, nice job on bottom posting as it doesn't seem common on this list.
-MC
Best, jungle ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info xmpp: jungle-boogie@jit.si
Slightly related: Sometimes I want to *listen* to the PCAP and wireshark takes a while or otherwise chokes on it. I've tried finding a tool, but they either didn't compile, weren't free, etc... any tips on an easy command-line version to extract audio from a PCAP? -Avi On Thu, Feb 5, 2015 at 3:35 AM, jungle Boogie <jungleboogie0@gmail.com> wrote:
Hi Michael, On 4 February 2015 at 15:01, Michael Collins <msc@freeswitch.org> wrote:
FYI,
I somehow stumbled across this: https://github.com/irontec/sngrep
It actually works really well and it perfect for what I need. After I get some experience with it I will add it to the wiki.
Looking forward to your write up!
By the way, nice job on bottom posting as it doesn't seem common on this list.
-MC
Best, jungle
------- inum: 883510009027723 sip: jungleboogie@sip2sip.info xmpp: jungle-boogie@jit.si
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Thu, Feb 5, 2015 at 5:14 AM, Avi Marcus <avi@avimarcus.net> wrote:
Slightly related: Sometimes I want to *listen* to the PCAP and wireshark takes a while or otherwise chokes on it. I've tried finding a tool, but they either didn't compile, weren't free, etc... any tips on an easy command-line version to extract audio from a PCAP?
Actually, there is. You just need tshark and some data. I wrote a pcap2wav utility here at work and I'll find out if it's okay to release it to the public. In the meantime the basic information on extracting the RTP sessions can be found here: http://stackoverflow.com/questions/6073868/how-to-stream-pcap-file-to-rtp-rt... Just keep in mind that this is only grabbing RTP in a particular direction. You can mux two streams together but just remember that they rarely start at exactly the same moment in time so you'll need to pad silence at the beginning of one of them. -MC
participants (4)
-
Avi Marcus
-
jungle Boogie
-
Michael Collins
-
Peter