Re: filter application layer frames during capture kernel (SIP)

[Anders Broman <anders.broman () ericsson com>]

Hi,
What you are trying to do is probably impossible. If you manage to do a capture filter of "INVITE" chances are that 
this packet is fragmented and the filter would then drop the fragments
And you end up with incomplete messages. To me the solutions(s) are to ether filter out unwanted traffic or only wanted 
traffic by filtering on IP, port or IP proto or something similar.
If you have media included, you don't want that...

If you get duplicated packets in your trace you could try to refine the monitor/span settings. You can also try to beef 
up your capturing platform.
On what OS and version are you doing capture? What is the packet rate? You can find that under Statistics->Capture file 
properties. This info would be
Interesting to us to know the current limitations.

Created by Wireshark 2.5.0 (ESVN Rev 4040 from /trunk)

File

Name:
C:\Development\bgfOL_00716_20180105123632.gz
Length:
200 MB
Format:
Wireshark/... - pcapng (gzip compressed)
Encapsulation:
Ethernet

Time

First packet:
2018-01-05 12:36:32
Last packet:
2018-01-05 12:36:52
Elapsed:
00:00:20

Capture

Hardware:
Intel(R) Xeon(R) CPU E5-2430 0 @ 2.20GHz (with SSE4.2)
OS:
Linux 4.4.0-96-generic
Application:
Dumpcap (Wireshark) 2.5.0-3990- (ESVN Rev 3990 from /trunk)

Interfaces

Interface
Dropped packets
Capture filter
Link type
Packet size limit
eth3
Unknown
ip net 10.80.29.80/28
Ethernet
65535 bytes

Statistics

Measurement
Captured
Displayed
Marked
Packets
220867
220867 (100.0%)
-
Time span, s
20.341
20.341
-
Average pps
10858.1
10858.1
-
Average packet size, B
872
872
-
Bytes
192634113
192634113 (100.0%)
0
Average bytes/s
9470 k
9470 k
-
Average bits/s
75 M
75 M
-


If you capture with Wireshark - don't. Use dumpcap and look at the resulting file(s).
Best regards
Anders

From: Wireshark-users [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Jaap Keuter
Sent: den 25 januari 2018 08:31
To: Community support list for Wireshark <wireshark-users () wireshark org>
Subject: Re: [Wireshark-users] filter application layer frames during capture kernel (SIP)

Hi,

Please review http://www.tcpdump.org/manpages/pcap-filter.7.html on what you capture filter options are.

Thanks,
Jaap

On 24 Jan 2018, at 19:27, Manolis Katsidoniotis <manoska () gmail com<mailto:manoska () gmail com>> wrote:

Hello

It's IMS (SIP, diameter, DNS, etc, ...)
I'm already filtering 5060 port only without translating IPs to names
and it's dropping 100s of frames
some of which are part of a failing flow so I can't tell what's happening.
Thus, I need to go in higher and filter more frames during capture so that I don't lose anything.
I'm not looking for complicated display filters functionality

But for example
the first line of any sip INVITE is

INVITE sip:bob () biloxi com<mailto:sip%3Abob () biloxi com> SIP/2.0
thus I can filter the first 8 bytes of the SIP header and match them to a string == "INVITE"

I could even convert INVITE to hex and do a byte to byte binary match for high speed matching
ie. something like
If bytes[0:5] == 49 4e 56 49 54 45 then keep the frame
otherwise drop it

similar to vlan matching, etc, etc,
and other capture filters which are already in place ...

This way I keep INVITEs and filter out SIP:REGISTER, SIP:MESSAGE, etc, ...
so I have a higher chance of geeting the frames I want.

But I don't see sip as an option in capture filters (I have checked both wireshark and linux:tcpdump)
I can see  tcp port http  but no sip.

If anyone happens to have any ideas let me know.

Thanks
Manolis

On Wed, Jan 24, 2018 at 9:06 AM Jaap Keuter <jaap.keuter () xs4all nl<mailto:jaap.keuter () xs4all nl>> wrote:
So is this traffic all SIP? Would it be sufficient to capture filter on UDP port 5060? Or do you need to index into the 
UDP payload?

On 24 Jan 2018, at 15:31, Manolis Katsidoniotis <manoska () gmail com<mailto:manoska () gmail com>> wrote:

Hello

Thanks.
Yes further to Guy's comment,
due to high traffic coming from servers which are faster than the capture equipment,
I need to filter during capture otherwise
specific frames which I need are dropped
while others that I don't need are captured.

Thanks
Manolis

On Tue, Jan 23, 2018 at 11:43 AM Guy Harris <guy () alum mit edu<mailto:guy () alum mit edu>> wrote:
On Jan 23, 2018, at 5:31 AM, Dignam, Mark <Mark.Dignam () ee co uk<mailto:Mark.Dignam () ee co uk>> wrote:

> Yeah in the filter option just add in sip contains XXXXXX (where XXXXXX is the MSISDN or part there of)

That's a *display* filter, so it won't filter out packets during the capture process.

Filtering specific SIP packets at capture time is much harder; see the ask.wireshark.com<http://ask.wireshark.com/> 
answer to which Anders pointed.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe