-
Notifications
You must be signed in to change notification settings - Fork 189
/
sngrep.8
200 lines (158 loc) · 5.17 KB
/
sngrep.8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
.\" Man page for the sngrep
.\"
.\" Copyright (c) 2013-2021 Ivan Alonso <kaian@irontec.com>
.\" Copyright (c) 2013-2021 Irontec S.L.
.TH SNGREP 8 "May 2021" "sngrep 1.4.10"
.SH NAME
sngrep \- SIP Messages flow viewer
.SH SYNOPSIS
.B sngrep [-hVcivlkNqE] [ -IO
.I pcap_dump
.B ] [ -d
.I dev
.B ] [ -l
.I limit
.B ] [ -k
.I keyfile
.B ] [-LH
.I capture_url
.B ] [
.I <match expression>
.B ] [
.I <bpf filter>
.B ]
.SH DESCRIPTION
sngrep is a terminal tool that groups SIP (Session Initiation Protocol)
Messages by Call-Id, and displays them in arrow flows similar to the used in
SIP RFCs. The aim of this tool is to make easier the process of learning or
debugging SIP. It recognizes UDP, TCP and partially TLS SIP packets and
understands bpf filter logic in the same way
.B ngrep (8)
and
.B tcpdump (1)
does.
.SH OPTIONS
.TP
.I \-h
Display help and usage information.
.TP
.I \-V
Display version information.
.TP
.I \-c
Only capture dialogs starting with an INVITE request.
.TP
.I \-i
Make match expression case insensitive.
.TP
.I \-v
Invert match expression.
.TP
.I \-I pcap_dump
Read packets from pcap file instead of network devices. This option can be used
with bpf filters.
.TP
.I \-O pcap_dump
Save all captured packets to a pcap file. This option can be used
with bpf filters.
.TP
.I -B buffer
Change size of pcap capture buffer (default: 2MB)
.TP
.I \-d dev
Use this capture device instead of default (\fIany\fP). Special keyword 'any', a device name like 'eth0' or a comma separated list like 'eth1,eth3'. This overrides the settings in the configuration file.
.TP
.I -k keyfile
Use private keyfile to decrypt TLS packets.
.TP
.I -l limit
Change default capture limit (20000 dialogs)
Limit must be a numeric value above 1 and can not be disabled. This is both
security measure to avoid unlimited memory usage and also used internally
in sngrep to manage hash table sizes.
.TP
.I -R
Remove oldest dialog when the capture limit has reached
Although not recommended, this can be used to keep sngrep running during long
times with some control over consumed memory.
.TP
.I -N
Don't display sngrep interface, just capture
.TP
.I -q
Don't print captured dialogs in no interface mode
.TP
.I -H
Send captured packets to a HEP server (like Homer or another sngrep)
Argument must be an IP address and port in the format: udp:A.B.C.D:PORT
.TP
.I -L
Start a HEP server listening for packets
Argument must be an IP address and port in the format: udp:A.B.C.D:PORT
.TP
.I -E
Enable parsing of captured HEP3 packets.
.TP
.I match expression
Match given expression in Messages' payload. If one request message matches the
given expression, the following messages within the same dialog will be also
captured.
.TP
.I bpf filter
Selects a filter that specifies what packets will be parsed. If no
\fIbpf filter\fP is given, all SIP packets seen on the selected
interface or pcap file will be displayed. Otherwise, only packets for which
\fIbpf filter\fP is `true' will be displayed.
.SH Interface
There are multiple windows to provide different information. Most of the
program windows have a help dialog with a brief description and useful
keybindings.
.SH " Call List Window"
.PP
The first window that sngrep shows is Call List window and display the
different SIP Call-Ids found in messages. The displayed columns depends on your
terminal width and your custom configuration. You can move between dialogs
with arrow keys and selected them using Spacebar. Selecting multiple dialogs
will display all them in Call flow window and Call Raw window, and will allow
to save only the selected message dialogs to a PCAP file.
.SH " Call Flow Window"
.PP
This window will a flow diagram of the selected dialogs' messages. The selected
message payload will be displayed in the right side of the window. You can move
between messages using arrow keys and select them using Spacebar. Selecting
multiple messages will display the Message Diff Window.
.SH " Call Raw Window"
.PP
This window will display the selected dialog messages in plain text. It was
designed to allow copying the messages payload easily. You can also save the
displayed information to a text file from this screen.
.SH " Column selection Window"
.PP
Columns displayed in Call List can be updated in this window. You can add or
remove columns or change their order in the list. Additionally, you can save
column state to be use in next sngrep execution.
.SH " Message Diff Window"
.PP
This window will compare two messages. Right now the comparison is done
searching each line in the other message, highlighting those not found exactly.
You can reach this window by selecting two messages using Spacebar in Call Flow
window
.SH FILES
Full paths below may vary between installations.
.PP
.I /etc/sngreprc
.IP
System\-wide configuration file. Some sngrep options can be overridden using
this file.
.PP
.I ~/.sngreprc
.IP
User's configuration file. If this file is present, options will be override
system\-wide configurations.
.SH BUGS
Please report bugs to the sngrep github project at
http://github.com/irontec/sngrep
Non-bug, non-feature-request general feedback should be sent to the
author directly by email.
.SH AUTHOR
Written by Ivan Alonso [a.k.a. Kaian] <kaian@irontec.com>.