Split large pcap by VoIP sessions

You can try do to that with TraceWrangler, using an "Extraction" task. By default, that task will split your file into sessions based on socket pairs. My guess is that each of your VoIP session has one specific socket pair which is different from all others.

I've never collected enough motivation to write a Lua listener, and now I know why.

If you are 150 % sure that the SIP part of your VoIP traffic uses solely non-fragmented UDP packets as transport, the Lua code below is what you asked for, except that I haven't tested it on captures containing RTCP or T.38 packets.

Fragmentation of SIP packets as well as use of TCP as SIP transport renders it unusable, because the way it is written, the listener always receives only the last fragment of reassembled SIP PDUs, regardless whether they have been reassembled from IP fragments or TCP segments (or both), because the SIP dissector is invoked only when processing the reassembled transport layer.

To fix this, it would be necessary to send to the listener all the IP fragments and TCP segments, and the listener would have to remember them until they would become reassembled and then, depending on whether the result of the reassembly contained a valid SIP PDU or not, either save them to the output file (possibly creating weird negative timestamp deltas if an RTP packet would squeeze between two fragments of a SIP PDU) or just drop them.

Also, bear in mind that the Dumper.new method appends data to existing files, so you have to clean up the output directory before opening the same source capture another time.

-- the output directory may be "hardcoded" this simple way,
-- but if you use command line (tshark) and thus you can set
-- environment variables, use
-- local outputdir = os.getenv("my_output_path")
-- as a way to fetch the path from an environment
-- variable "my_output_path" instead
local outputdir = "c:/Users/your_login/Documents"
– declare the Lua table for file handles
local files = {}
– declare the Lua table of frames containing SDPs
local sdp_frames = {}
– prepare the field extractors for the individual protocol types which we are tapping
local frame_number_f = Field.new("frame.number")
local rtp_setup_frame_f = Field.new("rtp.setup-frame")
local t38_setup_frame_f = Field.new("t38.setup-frame")
local rtcp_setup_frame_f = Field.new("rtcp.setup-frame")
local sip_callid_f = Field.new("sip.Call-ID")
local sip_method_f = Field.new("sip.Method")
local sip_to_tag_f = Field.new("sip.to.tag")
local sdp_version_f = Field.new("sdp.version")
– create and register the listener
local tap = Listener.new("ip", "rtp or rtcp or t38 or (sip and !(sip.CSeq.method == REGISTER) and !(sip.CSeq.method == OPTIONS))")
– declare the executive body of the tap
function tap.packet(pinfo,tvb,ip)
– declare a common function handling all media-like packets
function handle_media(setup_frame)
– if a setup frame for this media stream has actually been encountered, save the packet
if sdp_frames[setup_frame] then
files[sdp_frames[setup_frame]]:dump_current()
end
end
– attempt to extract all signature values
local frame_number = frame_number_f().value – I can do it this because frame.number always exists
local sip_callid = sip_callid_f()
local sip_method = sip_method_f()
local sip_to_tag = sip_to_tag_f()
local sdp_version = sdp_version_f()
local rtp_setup_frame = rtp_setup_frame_f()
local rtcp_setup_frame = rtcp_setup_frame_f()
local t38_setup_frame = t38_setup_frame_f()
– handle SIP packets
if sip_callid then
sip_callid_v = sip_callid.value
– check whether the PDU is an initial INVITE, and create a call if it is and if that call doesn't exist yet
– because there was an unauthorized initial INVITE before
sip_method = sip_method_f()
if sip_method then
if (sip_method.value == "INVITE" and not(sip_to_tag_f()) and not(files[sip_callid_v])) then
local f_handle = Dumper.new_for_current( outputdir .. "/" .. tostring(sip_callid) ..".pcap" )
files[sip_callid_v] = f_handle
end
end
– check whether the PDU contains an SDP and if so, add the frame to the list
– of those responsible for media stream establishment
if files[sip_callid_v] then
if sdp_version then
sdp_frames[frame_number] = sip_callid_v
end
end
– finally, if the frame belongs to an existing call, copy it to the output file
local f_handle = files[sip_callid_v]
if f_handle then
f_handle:dump_current()
end
end
– handle "media" packets
if rtp_setup_frame then
handle_media(rtp_setup_frame.value)
end
if rtcp_setup_frame then
handle_media(rtcp_setup_frame.value)
end
if t38_setup_frame then
handle_media(t38_setup_frame.value)
end
end
– declare the function to print the progress, not actually necessary
function tap.draw()
end
– declare what to do after the last packet has been processed
function tap.reset()
– close all files at once here, which may be way too late if there are hundreds of calls
– and so you may run out of your file handle quota
for call_id,f_handle in pairs(files) do
f_handle:flush()
f_handle:close()
end
end