#!/bin/bash input=$1 if [ -d "$input" ]; then input_dir=$input pcap_files=($(find ${input_dir} -type f -name "*.pcap")) elif [ -f "$input" ]; then input_file=$input pcap_files=($input_file) else echo "Usage: $0 input_pcap_dir or input_pcap_file" exit 1 fi # remove l7 protocol fields function replace() { file=$1 array=(":data" ":ntp" ":rip" ":isakmp" ":esp" ":udpencap" ":sip" ":sdp" ":rtcp" ":rtp" ":ssh" ":dns" ":ssl" ":gquic" ":http-text-lines" ":http" ":msmms" ":bfd" ":ftp-data-text-lines" ":ftp" ":ssdp" ":mdns" ":radius" ":pop" ":smtp" ":rtmpt" ":bittorrent" ":oicq" ":json" ":media" ":x11" ":telnet" ":nbss:smb" ":memcache" ":rtspi" ":rdt" ":rtsp" ":nbns" ":nbdgm:smb:browser" ":lcp" ":chap" ":ipcp" ":comp_data" ":ccp" ":snmp" ":socks" ":bgp" ":eigrp" ":bootp" ":xml" ":echo" ":vssmonitoring" ":mndp" ":websocket-text-lines" ":websocket" ":image-jfif" ":png" ":pkix1implicit" ":x509sat" ":x509ce" ":pkix1explicit" ":llmnr") for key in "${array[@]}"; do sed "s/$key//g" ${file} >.tmp.txt mv .tmp.txt ${file} done } output_dir="cmp_output/" for pcap in "${pcap_files[@]}"; do rm -rf ${output_dir} && mkdir ${output_dir} # tshark output frame.protocols tshark -r ${pcap} -T fields -e frame.number -e frame.protocols >>${output_dir}/tshark.txt # packet_parser output frame.protocols ./packet_parser -f ${pcap} -p >>${output_dir}/parser.txt # compare tshark and packet_parser output cp ${output_dir}/tshark.txt ${output_dir}/expect.txt replace ${output_dir}/expect.txt diff ${output_dir}/expect.txt ${output_dir}/parser.txt >>${output_dir}/diff.txt # print result line_count=$(cat ${output_dir}/diff.txt | wc -l) if [ "$line_count" -ne 0 ]; then printf "\033[31m ${pcap} TEST FAILED \033[0m\n" cat ${output_dir}/diff.txt | head -n 100 #exit 0 else printf "\033[32m ${pcap} TEST PASSED \033[0m\n" fi done