17
17
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
18
18
*
19
19
20
- Requirements:
21
-
22
- npm install cap
23
- npm install sipcore
24
- npm install hep-js
25
- npm install elasticsearch
26
-
27
-
28
20
Example Usage:
29
21
30
22
HEP3:
31
23
nodejs captagent.js -debug true -s 127.0.0.1 -p 9063 -i 2001
32
- ES:
33
- nodejs captagent.js -debug true -ES 'https://test.facetflow.io:443' -t 15
34
24
35
25
Daemonize using forever:
36
26
39
29
40
30
*/
41
31
42
- var version = 'v0.3 ' ;
32
+ var version = 'v0.4 ' ;
43
33
var debug = false ;
44
34
var sipdebug = false ;
45
35
var stats = { rcvd : 0 , parsed : 0 , hepsent : 0 , err : 0 , heperr : 0 } ;
@@ -57,13 +47,6 @@ if(process.argv.indexOf("-h") != -1){
57
47
console . log ( ' -i: HEP3 Agent ID' ) ;
58
48
console . log ( ' -P: HEP3 Password' ) ;
59
49
console . log ( ) ;
60
- console . log ( ' -ES: ES _Bulk API IP (ie: 127.0.0.1) ' ) ;
61
- console . log ( ' -EP: ES _Bulk API Port (ie: 443) ' ) ;
62
- console . log ( ' -EI: ES _Bulk API Index (ie: captagent)' ) ;
63
- console . log ( ' -ET: ES _Bulk API Type (ie: captagent)' ) ;
64
- console . log ( ' -EU: ES _Bulk API Auth (ie: user:pass)' ) ;
65
- console . log ( ' -t: ES _Bulk Frequency (in seconds)' ) ;
66
- console . log ( ) ;
67
50
console . log ( ' -debug: Debug Internals (ie: -debug true)' ) ;
68
51
console . log ( ' CRTL-C: Exit' ) ;
69
52
console . log ( ) ;
@@ -81,7 +64,6 @@ if(process.argv.indexOf("-h") != -1){
81
64
if ( process . argv . indexOf ( "-debug" ) != - 1 ) {
82
65
debug = process . argv [ process . argv . indexOf ( "-debug" ) + 1 ] ;
83
66
}
84
-
85
67
// HEP ARGS & DEFAULTS
86
68
var hep_server = 'localhost' ;
87
69
if ( process . argv . indexOf ( "-s" ) != - 1 ) {
@@ -100,99 +82,29 @@ if(process.argv.indexOf("-h") != -1){
100
82
hep_pass = process . argv [ process . argv . indexOf ( "-P" ) + 1 ] ;
101
83
}
102
84
103
- // ES ARGS & DEFAULTS (experimental, HTTPS default)
104
- var es_on = false ;
105
- var es_url = 'http://127.0.0.1:9200' ;
106
- var es_user = '' ;
107
-
108
- if ( process . argv . indexOf ( "-ES" ) != - 1 ) {
109
- es_url = process . argv [ process . argv . indexOf ( "-ES" ) + 1 ] ;
110
- es_on = true ;
111
- }
112
-
113
- var es_index = 'captagent' ;
114
- if ( process . argv . indexOf ( "-EI" ) != - 1 ) {
115
- es_index = process . argv [ process . argv . indexOf ( "-EI" ) + 1 ] ;
116
- }
117
- var es_type = 'captagent' ;
118
- if ( process . argv . indexOf ( "-ET" ) != - 1 ) {
119
- es_type = process . argv [ process . argv . indexOf ( "-ET" ) + 1 ] ;
120
- }
121
-
122
- if ( process . argv . indexOf ( "-EU" ) != - 1 ) {
123
- es_user = process . argv [ process . argv . indexOf ( "-EU" ) + 1 ] ;
124
- }
125
-
126
- var es_timeout = 30 ;
127
- if ( process . argv . indexOf ( "-t" ) != - 1 ) {
128
- es_timeout = parseInt ( process . argv [ process . argv . indexOf ( "-t" ) + 1 ] ) ;
129
- }
130
-
131
- var es_interval = es_timeout * 1000 ;
132
- // var es_buffer;
133
-
134
-
135
85
console . log ( 'Starting JSAgent ' + version ) ;
136
86
137
87
/* NODE.JS Requirements */
138
-
139
- var SIP = require ( 'sipcore' ) ;
140
- var Cap = require ( 'cap' ) . Cap ,
88
+ var SIP = require ( 'sipcore' ) ,
89
+ Cap = require ( 'cap' ) . Cap ,
141
90
decoders = require ( 'cap' ) . decoders ,
142
- PROTOCOL = decoders . PROTOCOL ;
143
-
144
- var HEPjs = require ( 'hep-js' ) ;
145
-
146
- /* ELASTICSEARCH Configuration */
147
- if ( es_on ) {
148
- var elasticsearch = require ( 'elasticsearch' ) ;
149
- if ( es_user . length > 1 ) { es_url = es_url . replace ( '://' , '://' + es_user + '@' ) ; }
150
-
151
- var client = new elasticsearch . Client ( {
152
- hosts : [
153
- es_url
154
- ]
155
- } ) ;
156
- }
157
-
91
+ PROTOCOL = decoders . PROTOCOL ,
92
+ HEPjs = require ( 'hep-js' ) ;
158
93
159
94
/* HEP OUT SOCKET */
160
-
161
- var dgram = require ( 'dgram' ) ;
162
- var socket = dgram . createSocket ( "udp4" ) ;
163
-
164
-
95
+ var dgram = require ( 'dgram' ) ,
96
+ socket = dgram . createSocket ( "udp4" ) ;
165
97
166
98
/* CAPTURE SOCKET */
167
-
168
99
var c = new Cap ( ) ,
169
100
device = Cap . findDevice ( ) ,
170
- // filter = 'port 5060',
171
101
filter = bpf_filter ,
172
102
bufSize = 10 * 1024 * 1024 ,
173
103
buffer = new Buffer ( 65535 ) ;
174
104
175
-
176
- /* HTTP SOCKET */
177
- if ( es_on ) {
178
- var es_buffer = '' ;
179
- setInterval ( function ( ) {
180
- if ( debug ) console . log ( "HTTP: Sending Statistics..." ) ;
181
- if ( buffer . length > 1 ) {
182
- // Send buffer and clear
183
- sendHTTP ( es_buffer + '\n' ) ;
184
- es_buffer = '' ;
185
- }
186
- } , es_interval ) ;
187
- }
188
-
189
-
190
-
191
105
/* APP START */
192
-
193
106
console . log ( 'Capturing from device ' + device + ' with BPF (' + bpf_filter + ')' ) ;
194
107
console . log ( 'Sending HEP3 Packets to ' + hep_server + ':' + hep_port + ' with id ' + hep_id ) ;
195
- if ( es_on ) console . log ( 'Sending JSON Packets to ' + es_url + ' _Bulk API with type ' + es_type ) ;
196
108
197
109
var linkType = c . open ( device , filter , bufSize , buffer ) ;
198
110
@@ -206,7 +118,6 @@ c.on('packet', function(nbytes, trunc) {
206
118
var hep_proto = { "type" : "HEP" , "version" : 3 , "payload_type" : "SIP" , "captureId" : hep_id , "capturePass" : hep_pass , "ip_family" : 2 } ;
207
119
208
120
// raw packet data === buffer.slice(0, nbytes)
209
-
210
121
if ( linkType === 'ETHERNET' ) {
211
122
var ret = decoders . Ethernet ( buffer ) ;
212
123
@@ -281,22 +192,8 @@ var parseSIP = function(msg, rcinfo){
281
192
if ( sipdebug ) console . log ( sipmsg ) ;
282
193
if ( debug ) console . log ( 'CSeq: ' + sipmsg . headers . cseq ) ;
283
194
stats . parsed ++ ;
284
- // SEND HEP3 Packet
285
- sendHEP3 ( sipmsg , msg , rcinfo ) ;
286
-
287
- if ( es_on ) {
288
- // PARSE USERS/URI for Elasticsearch Indexing
289
- sipmsg . headers [ "from_uri" ] = sipmsg . headers . from . match ( / ^ ( < s i p ) ( .* ) > / ) [ 0 ] ;
290
- sipmsg . headers [ "to_uri" ] = sipmsg . headers . to . match ( / ^ ( < s i p ) ( .* ) > / ) [ 0 ] ;
291
- sipmsg . headers [ "from_user" ] = sipmsg . headers . from . match ( / < s i p : ( .* ?) @ / ) [ 1 ] ;
292
- sipmsg . headers [ "to_user" ] = sipmsg . headers . to . match ( / < s i p : ( .* ?) @ / ) [ 1 ] ;
293
- // SESSION METHOD
294
- sipmsg . headers [ "sess_method" ] = sipmsg . headers . cseq . replace ( / [ ^ A - Z a - z \s ! ? ] / g, '' ) ;
295
- // INJECT NETWORK/HEP Headers
296
- sipmsg [ 'hep' ] = rcinfo ;
297
-
298
- bufferSIP ( sipmsg ) ;
299
- }
195
+ // SEND HEP3 Packet
196
+ sendHEP3 ( sipmsg , msg , rcinfo ) ;
300
197
}
301
198
catch ( e ) {
302
199
if ( debug ) console . log ( e ) ;
@@ -307,7 +204,6 @@ var parseSIP = function(msg, rcinfo){
307
204
308
205
309
206
/* HEP3 Socket OUT */
310
-
311
207
var sendHEP3 = function ( sipmsg , msg , rcinfo ) {
312
208
if ( sipmsg ) {
313
209
try {
@@ -331,42 +227,6 @@ var sendHEP3 = function(sipmsg,msg, rcinfo){
331
227
}
332
228
333
229
334
-
335
- /* JSON _Bulk Buffer */
336
-
337
- var bufferSIP = function ( data ) {
338
- if ( debug ) console . log ( 'Buffering SIP....' ) ;
339
- var now = new Date ( ) . toISOString ( ) . substring ( 0 , 10 ) . replace ( / - / g, '.' ) ;
340
- data [ "@timestamp" ] = new Date ( ) . toISOString ( ) . slice ( 0 , 19 ) + 'Z' ;
341
- es_buffer += '{"index":{"_index":"' + es_index + '-' + now + '","_type":"' + es_type + '"}}\n' + JSON . stringify ( data ) + '\n' ;
342
- }
343
-
344
-
345
-
346
- /* HTTP Socket OUT */
347
-
348
- var sendHTTP = function ( xbuffer ) {
349
- if ( xbuffer && xbuffer . length > 1 ) {
350
- try {
351
- if ( debug ) console . log ( 'Sending HTTP JSON Packet...' ) ;
352
- // post the data to Bulk using ES Client
353
- client . bulk ( {
354
- body : xbuffer
355
- } , function ( err , resp ) {
356
- if ( err ) console . log ( 'Err: ' , JSON . stringify ( err ) ) ;
357
- else if ( debug ) console . log ( 'Resp: ' , JSON . stringify ( resp ) ) ;
358
- } ) ;
359
-
360
- }
361
- catch ( e ) {
362
- console . log ( 'HTTP Error sending!' ) ;
363
- console . log ( e ) ;
364
- stats . heperr ++ ;
365
- }
366
- }
367
- }
368
-
369
-
370
230
/* UDP Socket Handler */
371
231
372
232
var getSocket = function ( type ) {
0 commit comments