??????????????+ ???????????

????4. ??????????????
??????????????н??и????????????????????????????????????????????SIP??????????????????????RTP(Real-time Transport Protocol????????Э??)?????
???????tcpdump????wireshark?????????????????????????е???????????????????????????????????????????????????????????????????????????λ???е??
??????????????pcapsipdump?????????????????????????λ?????????????????SIP??RTP?????????pcap????С?
????????????????????eth0??????????pcap???д??/home/admin/pcap???￡?????
????sudo pcapsipdump -i eth0 -d /home/admin/pcap
????5.???????н??
?????????????????????????????????????????????????????δ????????????????????????????С??????????
???????????tshark(wireshark???????а汾?????wireshark???????????)??????pcap???
??????????????????????????????SIP?????????
????tshark -Y sip -r pcapFile
????# output
????# 1   0.000000 198.xxx.xxx.xxx -> 202.xxx.xxx.xxx SIP/SDP 1137 Request: INVITE sip:390115170171@202.xxx.xxx.xxx:5060 |
????# 2   0.159216 202.xxx.xxx.xxx -> 198.xxx.xxx.xxx SIP 351 Status: 100 Trying |
????# 3   1.774173 202.xxx.xxx.xxx -> 198.xxx.xxx.xxx SIP/SDP 765 Status: 183 Session Progress |
????# 4   2.992899 202.xxx.xxx.xxx -> 198.xxx.xxx.xxx SIP/SDP 765 Status: 183 Session Progress |
????# 5   8.581402 202.xxx.xxx.xxx -> 198.xxx.xxx.xxx SIP/SDP 776 Status: 200 OK |
????# 6   8.582468 198.xxx.xxx.xxx -> 202.xxx.xxx.xxx SIP 458 Request: ACK sip:390115170171@202.xxx.xxx.xxx:5060 |
????# 7  15.702624 202.xxx.xxx.xxx -> 198.xxx.xxx.xxx SIP 417 Request: BYE sip:gw+gwName@198.xxx.xxx.xxx:5080;transport=udp;gw=gwName |
????# 8  15.703204 198.xxx.xxx.xxx -> 202.xxx.xxx.xxx SIP 477 Status: 200 OK |
?????????????￡???????????????????????????????????????????????????????￡?
????tshark -Y sip -r pcapFile|grep 'Status'|tail -n 1|awk -F '[:|]' '{print $2}'
????# output
????# 200 OK
???????????????????????????к????????????????????????????????SIP????????к?к??????????￡?
????tshark -Y "sip.Method == INVITE" -r pcapFile|head -n 1|awk -F '[:@+]' '{print $3}'
????# output
????# 390115170171
?????????к??????????????????д???С?????????????????????????е??г???????????????????????????????
????6.??η??????????????
???????????????????????????????У?????????????????????????????????????????????????????????????????д????????????RTP?????????????????????????????
????6.1 ??????
??????????????????????????pcap????л????????????????????????????tshark??????????????????????sox
?????????????????????????????shell????????pcap??????????wav?????????????????tshark?????????rtp.ssrc?????????????rtp.payload??HEX???????raw??????????sox???wav?????
if [ -z $1 ] ; then
echo "`basename $0` {pcap-file}"
exit
fi
for SSRC in `tshark -n -r $1 -Y rtp -T fields -e rtp.ssrc -Eseparator=??|sort -u`
do
tshark -n -r $1 -Y rtp -Y "rtp.ssrc == $SSRC" -T fields -e rtp.payload | tr : ' ' > $SSRC.payloads
> $SSRC.raw
for HEX in `cat $SSRC.payloads`
do
printf "\x$HEX" >> $SSRC.raw
done
[ -f $SSRC.wav ] && rm $SSRC.wav
sox -t raw -r 8000 -c 1 -e mu-law $SSRC.raw $SSRC.wav
if [ -z $A ] ; then
A=$SSRC
else
B=$SSRC
fi
done
rm *.payloads *.raw
sox -mM $A.wav $B.wav $A-$B.wav
??????????????????????????к???????????ú????????????????????????????????
????6.2 ?????
???????tshark?????pcap?????RTP????????????????ó?????????????????????????????????
tshark -q -z rtp??streams -r pcapFile
# output
# ========================= RTP Streams ========================
#     Src IP addr  Port    Dest IP addr  Port       SSRC          Payload  Pkts         Lost   Max Delta(ms)  Max Jitter(ms) Mean Jitter(ms) Problems?
#  202.xxx.xxx.xxx 28106  198.xxx.xxx.xxx 29728 0x1F62A4A1 ITU-T G.711 PCMU  1055     0 (0.0%)           20.75            0.17            0.05 X
#  198.xxx.xxx.xxx 29728  202.xxx.xxx.xxx 28106 0x99E37E4A ITU-T G.711 PCMU   975     0 (0.0%)           21.05            0.31            0.03 X
# ==============================================================
??????????????е?Src IP addr??Dest IP addr??Payload??Pkts??Lost??Max Delta(ms)??Max Jitter(ms)??Mean Jitter(ms)??μ??ɡ?
tshark -q -z rtp??streams -r pcapFile|sed -n '3??4p'|awk '{print $1??$3??$8??$9??$10$11??$12??$13??$14}'
# output
# 202.xxx.xxx.xxx 198.xxx.xxx.xxx PCMU 1055 0(0.0%) 20.75 0.17 0.05
# 198.xxx.xxx.xxx 202.xxx.xxx.xxx PCMU 975 0(0.0%) 21.05 0.31 0.03
?????????????????????????????к???????????????????????RTP???????????????????????????????????????????
??????????Щ?????????????????????????????????????????????????д??С????????????????????е???????????????д????????????????