Add tools packet_parser

test/packet_parser/cmp_layers.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+input=$1
+if [ -d "$input" ]; then
+    input_dir=$input
+    pcap_files=($(find ${input_dir} -type f -name "*.pcap"))
+elif [ -f "$input" ]; then
+    input_file=$input
+    pcap_files=($input_file)
+else
+    echo "Usage: $0 input_pcap_dir or input_pcap_file"
+    exit 1
+fi
+
+# remove l7 protocol fields
+function replace() {
+    file=$1
+    array=(":data" ":ntp" ":rip" ":isakmp" ":esp" ":udpencap" ":sip" ":sdp" ":rtcp" ":rtp" ":ssh" ":dns" ":ssl" ":gquic" ":http-text-lines" ":http" ":msmms" ":bfd" ":ftp-data-text-lines" ":ftp" ":ssdp" ":mdns" ":radius" ":pop" ":smtp" ":rtmpt" ":bittorrent" ":oicq" ":json" ":media" ":x11" ":telnet" ":nbss:smb" ":memcache" ":rtspi" ":rdt" ":rtsp" ":nbns" ":nbdgm:smb:browser" ":lcp" ":chap" ":ipcp" ":comp_data" ":ccp" ":snmp" ":socks" ":bgp" ":eigrp" ":bootp" ":xml" ":echo" ":vssmonitoring" ":mndp" ":websocket-text-lines" ":websocket" ":image-jfif" ":png" ":pkix1implicit" ":x509sat" ":x509ce" ":pkix1explicit" ":llmnr")
+    for key in "${array[@]}"; do
+        sed "s/$key//g" ${file} >.tmp.txt
+        mv .tmp.txt ${file}
+    done
+}
+
+output_dir="cmp_output/"
+for pcap in "${pcap_files[@]}"; do
+    rm -rf ${output_dir} && mkdir ${output_dir}
+
+    # tshark output frame.protocols
+    tshark -r ${pcap} -T fields -e frame.number -e frame.protocols >>${output_dir}/tshark.txt
+
+    # packet_parser output frame.protocols
+    ./packet_parser -f ${pcap} -p >>${output_dir}/parser.txt
+
+    # compare tshark and packet_parser output
+    cp ${output_dir}/tshark.txt ${output_dir}/expect.txt
+    replace ${output_dir}/expect.txt
+    diff ${output_dir}/expect.txt ${output_dir}/parser.txt >>${output_dir}/diff.txt
+
+    # print result
+    line_count=$(cat ${output_dir}/diff.txt | wc -l)
+    if [ "$line_count" -ne 0 ]; then
+        printf "\033[31m ${pcap} TEST FAILED \033[0m\n"
+        cat ${output_dir}/diff.txt | head -n 100
+        #exit 0
+    else
+        printf "\033[32m ${pcap} TEST PASSED \033[0m\n"
+    fi
+
+done