<div dir="ltr">Since you can already parse the pcap, here's a napkin sketch assuming something like php, bash, tcsh, etc. Were you looking for something more specific?<div><br></div><div>Find all INVITEs, store (as in-memory temp data) timestamps, Call-ID, and CSeq</div><div>Find first matching non-100 response for each INVITE based on Call-ID and Cseq (in case there are later reinvites)</div><div>Calculate difference in timestamp</div><div>...</div><div>Profit!</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 20, 2015 at 11:35 AM, Peter Beckman <span dir="ltr"><<a href="mailto:beckman@angryox.com" target="_blank">beckman@angryox.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks Matthew... but...<span class=""><br>
<br>
"I don't want to manage yet another server or metrics repository in order<br></span>
to hold all of this call data..."<br>
<br>
This requires a whole pile of new software to be installed AND MySQL to be<br>
run somewhere. <a href="http://www.voipmonitor.org/doc/Architecture" target="_blank">http://www.voipmonitor.org/doc/Architecture</a><br>
<br>
I have .pcap files from tcpdump with the call data. sngrep can parse it<br>
very fast and very well, but it is a curses-GUI and I need something I can<br>
automate.<br>
<br>
Dream workflow:<br>
<br>
sipgrep --packet-type-start INVITE --report pdd --direction outbound \<br>
--input-packet-capture sip07.pcap \<br>
| shell-script-mangle \<br>
| xargs -n1 push-metrics<br>
<br>
This way I can have a graph of PDD per termination partner (the<br>
shell-script-mangle would translate IP addresses into service provider<br>
tags/names) and push the metrics to my existing metrics system (statsd + graphite +<br>
grafana) and alert when things pass a threshold.<br>
<br>
Beckman<span class=""><br>
<br>
On Mon, 20 Apr 2015, Matthew Crocker wrote:<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
<a href="http://www.voipmonitor.org" target="_blank">www.voipmonitor.org</a><br>
<br>
PDD charts and so, so much more.<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
On Apr 20, 2015, at 5:11 PM, Peter Beckman <<a href="mailto:beckman@angryox.com" target="_blank">beckman@angryox.com</a>> wrote:<br>
<br>
So after a recent discussion about how to quickly diagnose SIP calls from<br>
packets (tcpdump + sngrep for the win!), I'm now wondering if there is a<br>
tool I don't know about that would be able to parse the same .pcap file<br>
that contains all of my port 5060 traffic and output the PDD time for each<br>
call found within. Bonus points if I can specify a time/date range.<br>
<br>
I don't want to manage yet another server or metrics repository in order to<br>
hold all of this call data, so some of the larger (and pricier) tools<br>
mentioned before are out for me.<br>
<br>
I've contacted the author of sngrep and though the packet capture code is<br>
already there, he reasonably doesn't want to turn sngrep into sipawk or<br>
sipsed.<br>
<br>
Beckman<br>
---------------------------------------------------------------------------<br>
Peter Beckman Internet Guy<br>
<a href="mailto:beckman@angryox.com" target="_blank">beckman@angryox.com</a> <a href="http://www.angryox.com/" target="_blank">http://www.angryox.com/</a><br>
---------------------------------------------------------------------------<br>
_______________________________________________<br>
VoiceOps mailing list<br>
<a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br>
</span><a href="https://urldefense.proofpoint.com/v1/url?u=https://puck.nether.net/mailman/listinfo/voiceops&k=eghE%2F1871Dg5AgRfLcYONw%3D%3D%0A&r=6u4D%2FXrxCS2CFGDR%2F10ITB7whz3CLQp1FhOexohJiTo%3D%0A&m=f3JKNUc1MsE7jFK9faN7F%2Fy8KIJ4OtgCKrTclex%2BqhM%3D%0A&s=7df9cc8d4717ef69b1427ff171b83de29281fb43ab72ffc000daf9311a4c8f73" target="_blank">https://urldefense.proofpoint.com/v1/url?u=https://puck.nether.net/mailman/listinfo/voiceops&k=eghE%2F1871Dg5AgRfLcYONw%3D%3D%0A&r=6u4D%2FXrxCS2CFGDR%2F10ITB7whz3CLQp1FhOexohJiTo%3D%0A&m=f3JKNUc1MsE7jFK9faN7F%2Fy8KIJ4OtgCKrTclex%2BqhM%3D%0A&s=7df9cc8d4717ef69b1427ff171b83de29281fb43ab72ffc000daf9311a4c8f73</a><br>
<br>
</blockquote>
<br>
<br>
<br>
</blockquote><div class="HOEnZb"><div class="h5">
<br>
---------------------------------------------------------------------------<br>
Peter Beckman Internet Guy<br>
<a href="mailto:beckman@angryox.com" target="_blank">beckman@angryox.com</a> <a href="http://www.angryox.com/" target="_blank">http://www.angryox.com/</a><br>
---------------------------------------------------------------------------<br>
_______________________________________________<br>
VoiceOps mailing list<br>
<a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
</div></div></blockquote></div><br></div>