Activity for pcapsipdump

Hiep Pham Hong created ticket #25

Hiep Pham Hong — Thu, 21 Mar 2024 10:43:18 -0000

Trigger close state not working

Hiep Pham Hong posted a comment on ticket #24

Hiep Pham Hong — Thu, 21 Mar 2024 10:38:13 -0000

Hello, Can I ask how the close trigger is working? Because I tried trigger close to run another cmd, the debug log did not appear when the call ended

Michael created ticket #24

Michael — Tue, 20 Feb 2024 17:32:13 -0000

Filter on two numbers via RegEx

Antonio posted a comment on ticket #21

Antonio — Thu, 04 May 2023 18:08:55 -0000

solution was to delete old pcapsipdump reinstall(update)libpcap intall pcapsipdump from svn

Antonio posted a comment on ticket #21

Antonio — Thu, 04 May 2023 16:35:44 -0000

have the same error on Centos no RTP in pcapsipdump i am usign it pcapsipdump -i eth0 -d /tmp/siplog/ when i do tcpdump -i eth0 -n -s 0 udp port 5060 or udp portrange 10000-50000 -v -w dump.cap and then open it with wireshark i can see RTP

Daniel Greenwald created ticket #12

Daniel Greenwald — Wed, 10 Nov 2021 20:40:58 -0000

Far side is behind NAT, pcapsipdump doesn't capture media

Saad Munir posted a comment on ticket #32

Saad Munir — Thu, 04 Nov 2021 10:53:43 -0000

Did you find the solution? I ran into a similar problem on RHEL 8.

Florian posted a comment on ticket #44

Florian — Mon, 29 Mar 2021 06:31:53 -0000

@Aex Aey: Any Updates / Ideas here ??...

Florian posted a comment on ticket #44

Florian — Thu, 11 Mar 2021 11:07:27 -0000

Yes, exactly.

Aex Aey posted a comment on ticket #44

Aex Aey — Thu, 11 Mar 2021 10:57:34 -0000

If we take an example of: From: "Joe Random" ...would that be "Joe Random" that you want to match on?

Florian created ticket #44

Florian — Thu, 11 Mar 2021 09:00:46 -0000

Filter / Output "SIP Display Info" Field

Code Medic created ticket #3

Code Medic — Sat, 16 Jan 2021 20:21:36 -0000

New versioned release

Alex Rozhnovskiy modified a comment on ticket #23

Alex Rozhnovskiy — Thu, 26 Nov 2020 17:05:40 -0000

Fixed with #include

Alex Rozhnovskiy modified a comment on ticket #23

Alex Rozhnovskiy — Thu, 26 Nov 2020 17:04:50 -0000

Fixed with #include

Alex Rozhnovskiy posted a comment on ticket #35

Alex Rozhnovskiy — Thu, 26 Nov 2020 07:36:14 -0000

I'm having the same problem in FreeBSD 11.3-RELEASE #0 r349754 libpcap version 1.9.0

Aex Aey modified a comment on ticket #43

Aex Aey — Tue, 24 Nov 2020 12:37:03 -0000

Fixed with #include

Alex Rozhnovskiy posted a comment on ticket #43

Alex Rozhnovskiy — Tue, 24 Nov 2020 08:07:11 -0000

Fixed with #include

Alex Rozhnovskiy posted a comment on ticket #23

Alex Rozhnovskiy — Tue, 24 Nov 2020 08:07:00 -0000

Fixed with #include

Alex Rozhnovskiy created ticket #43

Alex Rozhnovskiy — Mon, 23 Nov 2020 10:22:00 -0000

Compiling on FreeBSD 11.3

Alex Rozhnovskiy created ticket #23

Alex Rozhnovskiy — Mon, 23 Nov 2020 08:56:47 -0000

Compiling on FreeBSD

Leo Brown created ticket #42

Leo Brown — Fri, 29 May 2020 07:42:25 -0000

Segfault

Leo Brown created ticket #41

Leo Brown — Thu, 28 May 2020 17:35:01 -0000

Transparent Ethernet Bridging (Protocol 0x6558) Ignored

Mark Murawski created ticket #40

Mark Murawski — Tue, 05 May 2020 16:15:15 -0000

pcapsipdump does not dump all sip calls

Nerijus created ticket #22

Nerijus — Tue, 17 Mar 2020 06:21:52 -0000

Skipping lot of calls

david Villaume posted a comment on ticket #2

david Villaume — Wed, 04 Mar 2020 21:10:14 -0000

Hi Alex, Thanks a lot it works like a charm. Do you plan to add RTP capture for IPV6 ? tried to add it but failed. David

Aex Aey modified ticket #2

Aex Aey — Tue, 03 Mar 2020 17:01:31 -0000

ipv6 + vlan

Aex Aey posted a comment on ticket #2

Aex Aey — Tue, 03 Mar 2020 17:01:31 -0000

Should be fixed in [r157]. Can you give it a try?

Aex Aey committed [r157]

Aex Aey — Tue, 03 Mar 2020 16:59:14 -0000

add another encapsulation - 802.1Q-then-IPv6

david Villaume created ticket #2

david Villaume — Tue, 03 Mar 2020 16:52:26 -0000

ipv6 + vlan

Oliver Stange posted a comment on ticket #13

Oliver Stange — Wed, 22 Jan 2020 02:20:35 -0000

I found a solution to get working files. Tshark has a option to export PDUs. input from fritzbox | tshark -i - -w - | tshark -r - -U "OSI layer 4" -Y "sip or rtp or rtcp" -w capture.cap This works for me. Maybe you can add support for this "57 Unknown interface type (252)." so we can pipe from tshark into pcapsipdump :D

Oliver Stange posted a comment on ticket #13

Oliver Stange — Tue, 21 Jan 2020 13:55:11 -0000

Would be very nice if someone can fix this, i really need it for my work. I tried some tricks with tshark to filter sip/rtp/rtcp only traffic, because it cant filter (-f) from pipe stream. input from fritzbox | tshark -i - -Y "sip or rtp or rtcp" -x | text2pcap - capture.cap But the rtp packets are not visible as those. Maybe the same problem as with pcapsipdump.

Oliver Stange posted a comment on ticket #13

Oliver Stange — Sat, 18 Jan 2020 12:35:11 -0000

On IPv6 without ds lite i'm getting this: Can't get ip/port from SDP: v=0 o=user 8368762 8368762 IN IP6 2001:16b8:4100:2e90:9a9b:cbff:fe56:fc96 s=call c=IN IP6 2001:16b8:4100:2e90:9a9b:cbff:fe56:fc96 t=0 0 m=audio 7078 RTP/AVP 8 0 2 102 100 99 97 101 a=sendrecv a=rtpmap:2 G726-32/8000 a=rtpmap:102 G726-32/8000 a=rtpmap:100 G726-40/8000 a=rtpmap:99 G726-24/8000 a=rtpmap:97 iLBC/8000 a=fmtp:97 mode=30 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=rtcp:7079 a=ptime:20 v=0 o=user 8368762 8368762...

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 23:19:03 -0000

Ok some more is working. Seems IPv4 works without ds lite. But IPv6 is not working yet neither with or without ds lite. Here some captures:

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 22:49:16 -0000

Ok some more is working. Seems IPv4 works without ds lite. But IPv6 is not working yet neither with or without ds lite. Here some captures:

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 22:48:16 -0000

Ok some more is working. Seems IPv4 works fawlessly. But IPv6 is not working yet neither with or without ds lite. Here some captures:

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 21:18:27 -0000

Ok some more is working. But IPv6 is not working yet neither with or without ds lite. Here a capture of an outgoing call.

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 20:59:26 -0000

Ok some more is working. But IPv6 is not working yet neither with or without ds lite.

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 19:08:47 -0000

Youre a genius! All working now :) except ds-lite. ds lite still shows this Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet...

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 19:01:01 -0000

Oliver Stange posted a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 18:42:56 -0000

Youre a genius! All working now :) except ds-lite and nice debugging function. ds lite still shows this Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566 Skipping udp packet 2001:16b8:4103:7a5e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:73:41566...

Oliver Stange posted a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 15:46:48 -0000

Capture with ds lite still does not work, but with real dual stack it works now, but only on the pppoe interface without vlan (7). The pppoe interface with vlan gives me masses of this here: Can't parse Ethernet tags: 8100 0007 8864 1100 27c3 05d6 Can't parse Ethernet tags: 8100 0007 8864 1100 27c3 0036 Can't parse Ethernet tags: 8100 0007 8864 1100 27c3 05d6 Can't parse Ethernet tags: 8100 0007 8864 1100 27c3 05d6 Can't parse Ethernet tags: 8100 0007 8864 1100 27c3 05d6 Can't parse Ethernet tags:...

Aex Aey posted a comment on ticket #13

Aex Aey — Fri, 17 Jan 2020 15:46:35 -0000

First one (8100 0007 8864 1100 27c3 05d6) appears to be PPPoE inside an 802.1Q VLAN. I've added this in [r155] (untested, I don't have any pcaps with such traffic) On the LAN: - Ethernet tag 86dd is IPv6 - added in [r156] - Ethernet tag 88e1 homeplug (ethernet over powerline) protocol: https://en.avm.de/service/fritzbox/fritzbox-7360/knowledge-base/publication/show/249_Firewall-reports-attacks-on-TCP-port-80-or-14013-or-unsolicited-packets-of-type-0x88e1/ - Ethernet tag 8912 - can't figure this one...

Aex Aey committed [r156]

Aex Aey — Fri, 17 Jan 2020 15:44:39 -0000

support 0x86dd as IPv6 EtherType

Aex Aey committed [r155]

Aex Aey — Fri, 17 Jan 2020 15:38:13 -0000

support PPPoE-in-802.1Q

Aex Aey posted a comment on ticket #13

Aex Aey — Fri, 17 Jan 2020 11:48:38 -0000

Yes, of course. thank you for attaching. I've integrated your fix as [r152] With a fresh svn checkout, you should see SIP working on both native IPv6 and IPv4-tunneled-in-IPv6 (as is customary to do in DS-lite). However, RTP will likely still be missing (if SDP is not in the first fragment, like it is in the attached pcap). To make that work, we need teach pcapsipdump to do full segment reassembly. I'll add this on to-do list.

Oliver Stange posted a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 11:42:06 -0000

Did you test it against the cap file? Still does not work or do i need to add my fix after fresh svn checkout? To verify that i have no old stuff i did rm -fr pcapsipdump-code rm /usr/sbin/pcapsipdump

Aex Aey posted a comment on ticket #13

Aex Aey — Fri, 17 Jan 2020 05:57:41 -0000

[r154] should deal with DS-lite and some IPv6 fragmented packets, but latter is quite limited similarly to the IPv4 fragmenation handler - RTP will only be picked up if enough of SDP (m= and c=) are included in first fragment.

Aex Aey committed [r154]

Aex Aey — Fri, 17 Jan 2020 05:52:22 -0000

handle ipv4-in-ipv6 (a.k.a. dual-stack lite)

Aex Aey committed [r153]

Aex Aey — Fri, 17 Jan 2020 05:33:41 -0000

first attempt to handle ipv6 fragmentation

Aex Aey committed [r152]

Aex Aey — Fri, 17 Jan 2020 03:17:13 -0000

refactor ethernet header parsing and add pppoe support

Oliver Stange modified a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 02:27:10 -0000

When the provider is forcing a dual stack lite tunnel, its nearly impossible for pcapsipdump to find some packets. Unknown SIP method:''! Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252 Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252 Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252 Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252...

Oliver Stange posted a comment on ticket #13

Oliver Stange — Fri, 17 Jan 2020 02:16:18 -0000

When the provider is forcing dual stack lite, its nearly impossible for pcapsipdump to find the right packets. Unknown SIP method:''! Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252 Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252 Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252 Skipping udp packet 2001:16b8:4102:c71e:3a10:d5ff:fe0c:93fc:7078->2001:8d8:104:0:212:227:124:6:23252...

Aex Aey posted a comment on ticket #13

Aex Aey — Fri, 17 Jan 2020 02:01:33 -0000

Hi Oliver, thanks for reporing this. Would you be able to attach a .pcap file with pppoe ipv4/ipv6 sip packets? Just one packet for each(ipv4/ipv6) would be enough.

Oliver Stange created ticket #13

Oliver Stange — Thu, 16 Jan 2020 23:26:46 -0000

fix for direct input from avm fritzbox

micmac1 posted a comment on ticket #12

micmac1 — Wed, 09 Oct 2019 06:18:39 -0000

Morning, cleaned up the patch for pcapsipdump_lib.h a bit. Regards, Seb

micmac1 created ticket #12

micmac1 — Tue, 08 Oct 2019 20:40:28 -0000

Using libc's strlcpy if available

Aex Aey modified ticket #39

Aex Aey — Tue, 08 Oct 2019 09:19:23 -0000

Endian issue, pcapsipdump not working on big endian

micmac1 posted a comment on ticket #39

micmac1 — Mon, 07 Oct 2019 18:24:17 -0000

Hello Aex, It's working fine now without patches. I compile-tested on x86_64, once a native compile and once a cross-combile for MIPS BE, endian was properly detected during both. Run-tested on MIPS BE. Thank you very much! Regards, Seb P.S.: I didn't see a way to close this ticket. Maybe you can close it when you get around to it.

micmac1 posted a comment on ticket #39

micmac1 — Mon, 07 Oct 2019 11:35:15 -0000

Sure, will try when I get home and ping you back. Thanks!

Aex Aey posted a comment on ticket #39

Aex Aey — Mon, 07 Oct 2019 10:05:03 -0000

Ok, I you are right. I was confused beween solaris-style defines (either _LITTLE_ENDIAN == 1 or _BIG_ENDIAN == 1; other one undefined) and BSD/Linux-style defines (either __BYTE_ORDER == __LITTLE_ENDIAN or __BYTE_ORDER == __BIG_ENDIAN; all three always defined), so trunk since [r139] was broken on BE systems. Should be fixed in [r151], can you give it a try?

Aex Aey committed [r151]

Aex Aey — Mon, 07 Oct 2019 09:58:21 -0000

refactor endianness detection (fix #39 2/2)

Aex Aey modified a comment on ticket #39

Aex Aey — Mon, 07 Oct 2019 08:48:10 -0000

Hello Aex, I crosscompile on x86_64 with OpenWrt buildroot. gcc is 7.4.0 and libc in this case is musl. Will try tonight. I think __LITTLE_ENDIAN and __BIG_ENDIAN can't be used for tests, because they seem to be defined both at the same time. I put an #error below if !defined (__LITTLE_ENDIAN) && !defined (__BIG_ENDIAN) and the build never reached this error. Also, pcapsipdump testing like this ("do this if both __LITTLE_ENDIAN and __BIG_ENDIAN aren't defined") suggests this is normal. I found this...

micmac1 modified a comment on ticket #39

micmac1 — Mon, 07 Oct 2019 06:23:32 -0000

micmac1 modified a comment on ticket #39

micmac1 — Mon, 07 Oct 2019 06:22:44 -0000

micmac1 posted a comment on ticket #39

micmac1 — Mon, 07 Oct 2019 06:21:19 -0000

Aex Aey posted a comment on ticket #39

Aex Aey — Sun, 06 Oct 2019 22:10:52 -0000

Re: endinannes though - that is not what is going on here. __LITTLE_ENDIAN or __BIG_ENDIAN are used to construct packet header structs. On most systems, one of them is defined to indicate endianness (not both). If neither is defined, then, as a fallback __BYTE_ORDER is probed, and either __LITTLE_ENDIAN or __BIG_ENDIAN is defined locally. Do you complile this natively on BE host? Which gcc/libc? Can you try to compile lines 31..42 of pcapsipdump.h standalone to see if this is what compliler chokes...

Aex Aey modified ticket #39

Aex Aey — Sun, 06 Oct 2019 21:59:09 -0000

Endian issue, pcapsipdump not working on big endian

Aex Aey posted a comment on ticket #39

Aex Aey — Sun, 06 Oct 2019 21:58:11 -0000

time_t fix is in [r150], thanks!

Aex Aey committed [r150]

Aex Aey — Sun, 06 Oct 2019 21:56:50 -0000

Fix #39 (1/2)

micmac1 posted a comment on ticket #39

micmac1 — Sun, 06 Oct 2019 21:42:33 -0000

Here's the endian patch I used.

micmac1 created ticket #39

micmac1 — Sun, 06 Oct 2019 21:41:44 -0000

Endian issue, pcapsipdump not working on big endian

Aex Aey modified ticket #38

Aex Aey — Mon, 23 Sep 2019 15:00:33 -0000

Major bug -- Inverted logical expression

Aex Aey posted a comment on ticket #38

Aex Aey — Mon, 23 Sep 2019 15:00:33 -0000

Fixed in [r149], thanks for reporting! Note that while missing "!" before memcmp is indeed a bug, it was never a problem, being masked by another bug in the same line: confusion between sizeof (string constant length including final \0, i.e. memcmp does exact match) vs. strlen (string length excluding final \0, i.e. memcmp does prefix match). That is to say - if you don't see .pcap files being created, check other things too.

Aex Aey committed [r149]

Aex Aey — Mon, 23 Sep 2019 14:51:17 -0000

Fix #38

Andrea created ticket #38

Andrea — Mon, 23 Sep 2019 13:43:25 -0000

Major bug -- Inverted logical expression

Ivan posted a comment on ticket #37

Ivan — Mon, 02 Sep 2019 09:57:01 -0000

Hello. Thank you for explanations. Now I can split the file. Also, I was suprised that it is possible to set filetrs like TCP/UDP port. Thank you.

Aex Aey modified ticket #9

Aex Aey — Fri, 30 Aug 2019 23:02:44 -0000

Support q-in-q VLANs

Aex Aey posted a comment on ticket #9

Aex Aey — Fri, 30 Aug 2019 23:02:44 -0000

hm... looks like sf wouldn't allow me to set you as commit author :-/

Aex Aey modified ticket #9

Aex Aey — Fri, 30 Aug 2019 23:00:47 -0000

Support q-in-q VLANs

Aex Aey posted a comment on ticket #9

Aex Aey — Fri, 30 Aug 2019 23:00:47 -0000

Commited in [r148]. Thanks for contributing!

Aex Aey committed [r148]

Aex Aey — Fri, 30 Aug 2019 22:58:08 -0000

Allow q-in-q capture. This should really be dynamic number of tags - walk through all the 0x8100s until we get 0x0800

Aex Aey modified ticket #8

Aex Aey — Fri, 30 Aug 2019 22:52:21 -0000

BSD

Aex Aey modified a comment on ticket #37

Aex Aey — Fri, 30 Aug 2019 22:49:58 -0000

Thanks for reporting. According to /usr/include/pcap/dlt.h link type 113 is "Linux cooked sockets". This interface type (lo, tun, etc...) lack L2 header, and therefore vlan support. Vlan was, until now, part of default pcap filter expression. This should be fixed in [r147] (by dropping default pcap filter expression altogether). For earlier version, any explicit pcap expression compatible with linktype can be specified after all the other parameters, for example ip. This will override default pcap...

Aex Aey modified ticket #37

Aex Aey — Fri, 30 Aug 2019 22:48:13 -0000

Unable to split pcap file

Aex Aey posted a comment on ticket #37

Aex Aey — Fri, 30 Aug 2019 22:48:13 -0000

Aex Aey committed [r147]

Aex Aey — Fri, 30 Aug 2019 22:38:26 -0000

Drop the default pcap filter expression

Ivan created ticket #37

Ivan — Tue, 27 Aug 2019 15:50:49 -0000

Unable to split pcap file

Nathan Ward created ticket #11

Nathan Ward — Sat, 24 Aug 2019 06:41:27 -0000

Fix calltable cache segfaults

Nathan Ward created ticket #10

Nathan Ward — Sat, 24 Aug 2019 06:26:25 -0000

Make indenting consistent

Nathan Ward created ticket #9

Nathan Ward — Sat, 24 Aug 2019 06:24:06 -0000

Support q-in-q VLANs

Daniel Greenwald created ticket #21

Daniel Greenwald — Wed, 24 Jul 2019 19:17:03 -0000

Crashes since switching to AWS m5a instance type

Divyanshu Chauhan created ticket #36

Divyanshu Chauhan — Wed, 24 Jul 2019 12:47:30 -0000

pcapsipdump crashes while parsing packet greater than MTU

Daniel Greenwald posted a comment on ticket #22

Daniel Greenwald — Wed, 24 Apr 2019 01:36:26 -0000

Indeed, it works. Thanks for the speedy fix!

Aex Aey posted a comment on ticket #22

Aex Aey — Wed, 24 Apr 2019 01:12:21 -0000

Should be fixed in [r146], thanks for reporting!

Aex Aey committed [r146]

Aex Aey — Wed, 24 Apr 2019 01:11:09 -0000

Fix gettag()

Daniel Greenwald posted a comment on ticket #22

Daniel Greenwald — Tue, 23 Apr 2019 22:22:41 -0000

TCP support appears to be broken in r143 and forward. Only the first INVITE packet is captured. It works in r142. Thanks!

mn7474 posted a comment on ticket #35

mn7474 — Wed, 13 Feb 2019 19:28:12 -0000

Is there anything I can colelct for you that might help understand why yhis is happening?