sip可视化工具

sngrep

1.centos安装sngrep

vim /etc/yum.repos.d/irontec.repo

[irontec]
name=Irontec RPMs repository
baseurl=http://packages.irontec.com/centos/$releasever/$basearch/

rpm --import http://packages.irontec.com/public.key
yum install sngrep

2.命令行参数

Usage: sngrep [-hVcivNqrD] [-IO pcap_dump] [-d dev] [-l limit] [-B buffer] [-LH capture_url] [<match expression>] [<bpf filter>]

    -h --help        This usage
    -V --version     Version information
    -d --device      Use this capture device instead of default
    -I --input       Read captured data from pcap file
    -O --output      Write captured data to pcap file
    -B --buffer      Set pcap buffer size in MB (default: 2)
    -c --calls       Only display dialogs starting with INVITE
    -r --rtp         Capture RTP packets payload
    -l --limit       Set capture limit to N dialogs
    -i --icase       Make <match expression> case insensitive
    -v --invert      Invert <match expression>
    -N --no-interface    Don't display sngrep interface, just capture
    -q --quiet       Don't print captured dialogs in no interface mode
    -D --dump-config     Print active configuration settings and exit
    -f --config      Read configuration from file
    -F --no-config   Do not read configuration from default config file
    -R --rotate      Rotate calls when capture limit have been reached
    -H --eep-send    Homer sipcapture url (udp:X.X.X.X:XXXX)
    -L --eep-listen  Listen for encapsulated packets (udp:X.X.X.X:XXXX)

3.抓包效果

image.png

4. sngrep使用注意点

• 不要长时间用sngrep抓包，否则sgrep会占用非常多的内存。如果必须抓一段时间的包，务必使用tcpdump。
• 某些情况下，sngrep会丢包
• 某些情况下，sngrep会什么包都抓包不到，注意此时很可能要使用-d去指定抓包的网卡