python SIP日志文件处理

Question

我有一个由 py​​thon scapy 生成的 VoIP/SIP 嗅探/日志文件，格式为时间 |来源 |源端口 |目的地 |目的地端口 |有效负载sniff python 脚本如下所示:

## Import Scapy module
from scapy.all import *
import sys

sys.stdout = open('data.txt', 'w')

pkts = sniff(filter="udp and port 5060 and not port 22", count=0,prn=lambda x:x.sprintf("%sent.time% | %IP.src% | %IP.sport% | %IP.dst% | %IP.dport% | Payload {Raw:%Raw.load%\n}"))

一行中的每个数据包，每行可以有不同的大小，具体取决于 SIP 消息类型(注册、200 OK、邀请、通知等...)

我想从文件中获取的是字段时间、src、srcport、dst、dstport 和 SIP 消息的 Payload 类型(就在 Payload 之后)、From、To、Call-iD、Contact以及整个有效负载，然后准备将它们插入 MySQL 数据库。

1st msg:
07:57:01.894990 | 192.168.1.10 | 5060 | 192.168.1.1 | 5060 | Payload 'INVITE sip:210@test-lab.org SIP/2.0\r\nVia: 
SIP/2.0/UDP 192.168.1.10:5060;rport;branch=z9hG4bK-9cbb0ba8\r\nRoute: <sip:192.168.1.1:5060;lr>\r\nFrom: "test-311" <sip:311@test-lab.org>;tag=3d13bd6f\r\n
To: <sip:210@test-lab.org>\r\nCall-ID: 21b0e2c755973976d6d06702ca33b32f@10.193.40.249\r\nCSeq: 1 INVITE\r\n
Contact: "test-311" <sip:311@192.168.1.10:5060;transport=UDP>\r\nMax-Forwards: 70\r\n
Supported: 100rel,replaces\r\nAllow: ACK, BYE, CANCEL, INFO, INVITE, OPTIONS, NOTIFY, PRACK, REFER, UPDATE, MESSAGE\r\nContent-Type: application/sdp\r\nContent-Length:   276\r\n\r\nv=0\r\no=- 3506863524 285638052 IN IP4 192.168.1.10\r\ns=-\r\nc=IN IP4 192.168.1.10\r\nt=0 0\r\nm=audio 8000 RTP/AVP 8 0 18 101\r\nc=IN IP4 192.168.1.10\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:18 G729/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-15\r\na=ptime:20\r\n'

2nd msg:
07:57:01.902618 | 192.168.1.1 | 5060 | 192.168.1.10 | 5060 | Payload 'SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP 192.168.1.10:5060;received=192.168.1.10;branch=z9hG4bK-9cbb0ba8;rport=5060\r\nFrom: "test-311" <sip:+38551311@test-lab.org>;tag=3d13bd6f\r\nTo: <sip:210@test-lab.org>\r\nCall-ID: 21b0e2c755973976d6d06702ca33b32f@192.168.1.10\r\nCSeq: 1 INVITE\r\n\r\n'

我尝试逐行读取并拆分，但我不知道如何拆分并从有效负载部分获取数据。欢迎任何帮助。

Answer 1

嗯，你也可以直接从这个程序将数据输入mysql；这很可能是最简单的方法。

from scapy.all import *
import sys

# connect to mysql 
connection = ...

def insert_into_mysql(packet):
    # now you can use packet.src, packet.sport, packet.dst, packet.dport, and
    # I believe packet['Raw'].load
    connection.execute(...)

    # to not print the packet
    return None

    # to print the packet
    return x.sprintf("%sent.time% | %IP.src% | %IP.sport% | %IP.dst% | %IP.dport% | Payload {Raw:%Raw.load%\n}"

pkts = sniff(filter="udp and port 5060", count=0, store=0, prn=insert_into_mysql)

但是如果你需要使用现有的日志，我认为你需要使用:

for line in open('log.txt'):
    sent_time, src, sport, dst, dport, payload = line.split(' | ', 6)
    payload = payload.replace('Payload ', '')

    # to get the unquoted payload, I'd guess (can't test SIP though)
    from ast import literal_eval
    payload = literal_eval(payload)