package main import ( "flag" "fmt" //"os" "encoding/binary" "encoding/hex" "io/ioutil" "os/exec" ) const magicMicroseconds = 0xa1b2c3d4 const versionMajor = 2 const versionMinor = 4 func WriteEmptyPcap(filename string, timestamp int64, length int, data []byte) error { var cooked = [...]byte{0x00,0x00,0x03,0x04,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x00} var buf []byte //24+16+16 = 56 buf = make([]byte, 56+length) binary.LittleEndian.PutUint32(buf[0:4], magicMicroseconds) binary.LittleEndian.PutUint16(buf[4:6], versionMajor) binary.LittleEndian.PutUint16(buf[6:8], versionMinor) // bytes 8:12 stay 0 (timezone = UTC) // bytes 12:16 stay 0 (sigfigs is always set to zero, according to // http://wiki.wireshark.org/Development/LibpcapFileFormat binary.LittleEndian.PutUint32(buf[16:20], 0x00040000) binary.LittleEndian.PutUint32(buf[20:24], 0x00000071) // Packet Header binary.LittleEndian.PutUint64(buf[24:32], uint64(timestamp)) binary.LittleEndian.PutUint32(buf[32:36], uint32(length+16)) binary.LittleEndian.PutUint32(buf[36:40], uint32(length+16)) copy(buf[40:], cooked[:]) copy(buf[56:], data[:]) err := ioutil.WriteFile(filename, buf[:], 0644) //fmt.Printf("CAP: %v\n", buf) return err } //tshark -r gtp.pcap -T json -d tcp.port==8080,http2 -Y "http2" func execTshark(html string, filename string, proto string, port int) { var tshark *exec.Cmd var sharkCmd string pcapPath := filename dataPort := fmt.Sprintf("tcp.port==%d,http2", port) if proto == "http2" { //tshark = exec.Command("tshark", "-r"+pcapPath, // "-Y"+proto, // "-d"+dataPort, // "-T", "pdml") sharkCmd = fmt.Sprintf("tshark -r %s -T pdml -d tcp.port==%d,http2 -Y \"%s\" > %s.pdml", pcapPath, dataPort, proto, pcapPath) tshark = exec.Command("sh", "-c", sharkCmd) } else { //tshark = exec.Command("tshark", "-r"+pcapPath, // "-Y"+proto, // "-T", "pdml") sharkCmd = fmt.Sprintf("tshark -r %s -T pdml -Y \"%s\" > %s.pdml", pcapPath, proto, pcapPath) tshark = exec.Command("sh", "-c", sharkCmd) } _, err := tshark.CombinedOutput() if err != nil { fmt.Printf("tshark failed with %s\n", err) } else { //fmt.Printf("combined out:\n%s\n", string(out)) pdmlFile := fmt.Sprintf("%s.pdml", filename) //err1 := os.WriteFile(pdmlFile, []byte(out), 0666) //if err1 != nil { // fmt.Println("write html failed") //}else { //xsltproc pdml2html.xsl ngap.pdml > /home/agtuser/ngap.html command := fmt.Sprintf("xsltproc /usr/lib64/pdml2html.xsl %s > %s", pdmlFile, html) dest := exec.Command("sh", "-c", command) _, err2 := dest.Output() if err2 != nil { fmt.Println("Error:", err2, command) } //} } } func ipDataHandle(html string, iftype string, port int, timestamp int64, data []byte) int { var filePath, proto string if iftype == "N2" || iftype == "N1" { filePath = fmt.Sprintf("/tmp/ng%d.pcap", timestamp) proto = "ngap" }else if iftype == "N4" { filePath = fmt.Sprintf("/tmp/pf%d.pcap", timestamp) proto = "pfcp" }else { filePath = fmt.Sprintf("/tmp/hp%d.pcap", timestamp) proto = "http2" } err := WriteEmptyPcap(filePath, timestamp, len(data), data) if err != nil { fmt.Printf("tshark failed with %s\n", err) } else { execTshark(html, filePath, proto, port) } return 0 } func main() { var html, iftype, ipdata string var timestamp int64 var port int flag.Int64Var(×tamp,"t",0,"timestamp") flag.StringVar(&iftype,"i","","interface type") flag.IntVar(&port,"p",0,"data port") flag.StringVar(&ipdata,"d","","ip packet data") flag.StringVar(&html,"f","","html file path") flag.Parse() ds, err := hex.DecodeString(ipdata) if err != nil { return } ipDataHandle(html, iftype, port, timestamp, ds) }