[OpenSIPS-Users] TLS traffic visualization HOWTO

[Giovanni Maruzzelli]

# How to TRACE and visualize TLS and non-TLS SIP traffic in real time
(thanks to Homer's Lorenzo Mangani for pointing me toward Frida)

apt-get install python-pip
pip install frida
pip install hexdump
wget https://raw.githubusercontent.com/google/ssl_logger/master/ssl_logger.py

#first ssh terminal
# create fifo pipe, then will send the content from fifo pipe to an
sngrep without gui, which will be reading pcap from stdin, and sending
eep packets to the other sngrep (third terminal)

mkfifo /tmp/pipe
cat /tmp/pipe | sngrep -N -q -H udp:127.0.0.1:5077 -I -

#second ssh terminal
# writes as pcap to fifo pipe what freeswitch writes and reads from ssl lib

python ssl_logger_giova.py -pcap /tmp/pipe freeswitch

#third ssh terminal
# sngrep that receives packets from both the Ethernet device, and the
eep packets sent by the other sngrep (eg, the tls packets ssl_logger
grabs from freeswitch's ssl lib)

sngrep -L udp:127.0.0.1:5077

(you may want to edit ssl_logger.py and change 228 to be 101 -
LINKTYPE_IPV4 to be LINKTYPE_RAW )



-- 
Sincerely,

Giovanni Maruzzelli
OpenTelecom.IT
cell: +39 347 266 56 18
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20190204/19175f79/attachment-0001.html>