51 lines
1.9 KiB
Bash
51 lines
1.9 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
input=$1
|
||
|
|
if [ -d "$input" ]; then
|
||
|
|
input_dir=$input
|
||
|
|
pcap_files=($(find ${input_dir} -type f -name "*.pcap"))
|
||
|
|
elif [ -f "$input" ]; then
|
||
|
|
input_file=$input
|
||
|
|
pcap_files=($input_file)
|
||
|
|
else
|
||
|
|
echo "Usage: $0 input_pcap_dir or input_pcap_file"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# remove l7 protocol fields
|
||
|
|
function replace() {
|
||
|
|
file=$1
|
||
|
|
array=(":data" ":ntp" ":rip" ":isakmp" ":esp" ":udpencap" ":sip" ":sdp" ":rtcp" ":rtp" ":ssh" ":dns" ":ssl" ":gquic" ":http-text-lines" ":http" ":msmms" ":bfd" ":ftp-data-text-lines" ":ftp" ":ssdp" ":mdns" ":radius" ":pop" ":smtp" ":rtmpt" ":bittorrent" ":oicq" ":json" ":media" ":x11" ":telnet" ":nbss:smb" ":memcache" ":rtspi" ":rdt" ":rtsp" ":nbns" ":nbdgm:smb:browser" ":lcp" ":chap" ":ipcp" ":comp_data" ":ccp" ":snmp" ":socks" ":bgp" ":eigrp" ":bootp" ":xml" ":echo" ":vssmonitoring" ":mndp" ":websocket-text-lines" ":websocket" ":image-jfif" ":png" ":pkix1implicit" ":x509sat" ":x509ce" ":pkix1explicit" ":llmnr")
|
||
|
|
for key in "${array[@]}"; do
|
||
|
|
sed "s/$key//g" ${file} >.tmp.txt
|
||
|
|
mv .tmp.txt ${file}
|
||
|
|
done
|
||
|
|
}
|
||
|
|
|
||
|
|
output_dir="cmp_output/"
|
||
|
|
for pcap in "${pcap_files[@]}"; do
|
||
|
|
rm -rf ${output_dir} && mkdir ${output_dir}
|
||
|
|
|
||
|
|
# tshark output frame.protocols
|
||
|
|
tshark -r ${pcap} -T fields -e frame.number -e frame.protocols >>${output_dir}/tshark.txt
|
||
|
|
|
||
|
|
# packet_parser output frame.protocols
|
||
|
|
./packet_parser -f ${pcap} -p >>${output_dir}/parser.txt
|
||
|
|
|
||
|
|
# compare tshark and packet_parser output
|
||
|
|
cp ${output_dir}/tshark.txt ${output_dir}/expect.txt
|
||
|
|
replace ${output_dir}/expect.txt
|
||
|
|
diff ${output_dir}/expect.txt ${output_dir}/parser.txt >>${output_dir}/diff.txt
|
||
|
|
|
||
|
|
# print result
|
||
|
|
line_count=$(cat ${output_dir}/diff.txt | wc -l)
|
||
|
|
if [ "$line_count" -ne 0 ]; then
|
||
|
|
printf "\033[31m ${pcap} TEST FAILED \033[0m\n"
|
||
|
|
cat ${output_dir}/diff.txt | head -n 100
|
||
|
|
#exit 0
|
||
|
|
else
|
||
|
|
printf "\033[32m ${pcap} TEST PASSED \033[0m\n"
|
||
|
|
fi
|
||
|
|
|
||
|
|
done
|