If you find yourself in that gray area where COTS hardware can't save the day anymore, but you're not looking to spend Empirix money, Endace makes some really good cards on which to develop your own very robust systems:<br>
<br><a href="http://www.endace.com/">http://www.endace.com/</a><br><br>-N<br><br><br><div class="gmail_quote">On Wed, Jun 23, 2010 at 11:49 AM, Justin Randall <span dir="ltr"><<a href="mailto:jrandall@comwave.net">jrandall@comwave.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="white" link="blue" vlink="purple" lang="EN-CA">
<div>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;">Hello,</span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;">With an understanding of Wireshark and/or PCAP file structure and a
little Perl magic you can whip up a simple script in less than 100 lines which
will pull the exact information you’re looking for from existing PCAP
files.</span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;">As for real-time capturing, I can’t speak with any
familiarity for Alex’s product however I can say that scalability of any solutions
for real-time capturing/analysis without any type of ASICs or custom hardware have
limited scalability, especially if you’re capturing all signalling and media
for all call legs for several thousands of simultaneous calls at once in a
multi-protocol VoIP environment. We have had to rely on a commercial
hardware/software vendor solution in order to capture larger volumes of traffic
without loss. You can still pull a decent solution together without a
full commercial solution using a special NIC, carefully tuned PCAP filters, and
a sufficiently distributed L2 switching network.</span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;">Regards,</span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;"> </span></p>
<div>
<p class="MsoNormal"><span style="color: blue;">Justin
Randall</span><span style="color: blue;"></span></p>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;">Team Leader - VoIP Engineering</span><span style="color: blue;"></span></p>
</div>
<p class="MsoNormal"><span style="font-size: 10pt; color: blue;">Comwave Telecom Inc.</span><span style="font-size: 10pt; color: blue;"></span></p>
<div>
<div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;">
<p class="MsoNormal"><b><span style="font-size: 10pt; color: windowtext;" lang="EN-US">From:</span></b><span style="font-size: 10pt; color: windowtext;" lang="EN-US">
<a href="mailto:voiceops-bounces@voiceops.org" target="_blank">voiceops-bounces@voiceops.org</a> [mailto:<a href="mailto:voiceops-bounces@voiceops.org" target="_blank">voiceops-bounces@voiceops.org</a>] <b>On
Behalf Of </b>Brooks Bridges<br>
<b>Sent:</b> June-23-10 2:23 PM<br>
<b>To:</b> 'Lee Riemer'; <a href="mailto:voiceops@voiceops.org" target="_blank">voiceops@voiceops.org</a><div><div></div><div class="h5"><br>
<b>Subject:</b> Re: [VoiceOps] Splitting SIP+RTP PCAP files</div></div></span></p>
</div>
</div><div><div></div><div class="h5">
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US">It does not. We didn’t see a need for that, as we
use it as a real-time “backlog” of calls for troubleshooting.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span></p>
<div>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Brooks R. Bridges</span></i></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Telecommunications Manager</span></i></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Ifbyphone, Inc.</span></i></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Phone: (847) 983-3000</span></i></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Fax: (847) 676-6553</span></i></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US"><a href="mailto:bbridges@ifbyphone.com" target="_blank">bbridges@ifbyphone.com</a></span></i></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US"><a href="http://www.ifbyphone.com" target="_blank">http://www.ifbyphone.com</a></span></i></p>
</div>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span></p>
<div>
<div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;">
<p class="MsoNormal"><b><span style="font-size: 10pt; color: windowtext;" lang="EN-US">From:</span></b><span style="font-size: 10pt; color: windowtext;" lang="EN-US">
<a href="mailto:voiceops-bounces@voiceops.org" target="_blank">voiceops-bounces@voiceops.org</a> [mailto:<a href="mailto:voiceops-bounces@voiceops.org" target="_blank">voiceops-bounces@voiceops.org</a>] <b>On
Behalf Of </b>Lee Riemer<br>
<b>Sent:</b> Wednesday, June 23, 2010 12:18 PM<br>
<b>To:</b> <a href="mailto:voiceops@voiceops.org" target="_blank">voiceops@voiceops.org</a><br>
<b>Subject:</b> Re: [VoiceOps] Splitting SIP+RTP PCAP files</span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">Will it work on data already captured in
.pcap files?<br>
<br>
On 6/23/2010 12:07 PM, Brooks Bridges wrote: </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US">The utility was written by Alex as a replacement for
pcapsipdump. pcapsipdump suffers from severe performance and stability
problems with any appreciable traffic.</span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US">I can vouch that Alex’s utility is very stable and
efficient, but I do have to take exception to the “inexpensive (read:
basically free!)” statement, as the utility is wholly owned (as per work-for-hire
agreement) by Ifbyphone, Inc.</span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US">Please contact me off-list if you would like to discuss using
the utility. I do not believe there is an issue with us releasing the
utility “free as in beer”, however I am not the one that can
authorize such a release. I will have to confirm this with our upper
management.</span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US">Thanks</span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span><span lang="EN-US"></span></p>
<div>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Brooks R. Bridges</span></i><span lang="EN-US"></span></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Telecommunications Manager</span></i><span lang="EN-US"></span></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Ifbyphone, Inc.</span></i><span lang="EN-US"></span></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Phone: (847) 983-3000</span></i><span lang="EN-US"></span></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US">Fax: (847) 676-6553</span></i><span lang="EN-US"></span></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US"><a href="mailto:bbridges@ifbyphone.com" target="_blank">bbridges@ifbyphone.com</a></span></i><span lang="EN-US"></span></p>
<p class="MsoNormal"><i><span style="font-size: 11pt; font-family: "Cambria","serif"; color: rgb(31, 73, 125);" lang="EN-US"><a href="http://www.ifbyphone.com" target="_blank">http://www.ifbyphone.com</a></span></i><span lang="EN-US"></span></p>
</div>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125);" lang="EN-US"> </span><span lang="EN-US"></span></p>
<div>
<div style="border-style: solid none none; border-color: -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;">
<p class="MsoNormal"><b><span style="font-size: 10pt;" lang="EN-US">From:</span></b><span style="font-size: 10pt;" lang="EN-US"> <a href="mailto:voiceops-bounces@voiceops.org" target="_blank">voiceops-bounces@voiceops.org</a> [<a href="mailto:voiceops-bounces@voiceops.org" target="_blank">mailto:voiceops-bounces@voiceops.org</a>]
<b>On Behalf Of </b>Darren Schreiber<br>
<b>Sent:</b> Wednesday, June 23, 2010 11:58 AM<br>
<b>To:</b> Nicholas Sten; Kristian Kielhofner<br>
<b>Cc:</b> <a href="mailto:voiceops@voiceops.org" target="_blank">voiceops@voiceops.org</a><br>
<b>Subject:</b> Re: [VoiceOps] Splitting SIP+RTP PCAP files</span><span lang="EN-US"></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<pre><span lang="EN-US">What's wrong with pcapsipdump? You can pipe input into that I believe... its an old tool but it still works. :-)</span><span lang="EN-US"></span></pre><pre><span lang="EN-US"> </span><span lang="EN-US"></span></pre>
<pre><span lang="EN-US">Nicholas Sten <a href="mailto:nicksten@gmail.com" target="_blank"><nicksten@gmail.com></a> wrote:</span><span lang="EN-US"></span></pre><pre><span lang="EN-US"> </span><span lang="EN-US"></span></pre>
<div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span lang="EN-US">Kristian,<br>
<br>
Alex has an elegant and inexpensive (read: basically free!) solution that you
might want to check out. Here's a brief description (I've culled from a
personal email, so I hope I don't misrepresent it)<br>
<br>
<i>So I wrote a highly parallelised, multithreaded tool that runs on such a
"capture box" and listens to SIP traffic intelligently. It
automatically identifies the media ports involved in a call and records both
SIP and RTP to distinct capture files in a dated directory hierarchy separated
by day and hour. The capture file contains the date, time, ANI, DNIS and
Call-ID.</i><br>
<br>
You should give him a shout: Alex Balashov <<a href="mailto:abalashov@evaristesys.com" target="_blank">abalashov@evaristesys.com</a>><br>
<br>
I can vouch for the quality and effectiveness of his solutions.<br>
<br>
-N<br>
<br>
</span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">On Wed, Jun 23, 2010 at 9:02 AM, Kristian
Kielhofner <<a href="mailto:kristian.kielhofner@gmail.com" target="_blank">kristian.kielhofner@gmail.com</a>>
wrote:</span></p>
<p class="MsoNormal"><span lang="EN-US">Hello everyone,<br>
<br>
Does anyone know of a tool to split PCAP files that is SIP+RTP<br>
aware? Ideally I'd be able to record a PCAP file with any number of<br>
calls and then have a utility split that file into each separate call?<br>
I'm pretty sure I've seen a utility to do this, I just can't remember<br>
the name...<br>
<br>
Thanks!<br>
<br>
--<br>
Kristian Kielhofner<br>
<a href="http://www.astlinux.org" target="_blank">http://www.astlinux.org</a><br>
<a href="http://blog.krisk.org" target="_blank">http://blog.krisk.org</a><br>
<a href="http://www.star2star.com" target="_blank">http://www.star2star.com</a><br>
<a href="http://www.submityoursip.com" target="_blank">http://www.submityoursip.com</a><br>
<a href="http://www.voalte.com" target="_blank">http://www.voalte.com</a><br>
_______________________________________________<br>
VoiceOps mailing list<br>
<a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
</div>
<pre><span lang="EN-US"> </span></pre><pre><span lang="EN-US"> </span></pre><pre><span lang="EN-US">_______________________________________________</span></pre><pre><span lang="EN-US">VoiceOps mailing list</span></pre><pre>
<span lang="EN-US"><a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a></span></pre><pre><span lang="EN-US"><a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a></span></pre>
<pre><span lang="EN-US"> </span></pre></div></div></div>
</div>
<br>_______________________________________________<br>
VoiceOps mailing list<br>
<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
<br></blockquote></div><br>