sngrep
1.centos安装sngrep
vim /etc/yum.repos.d/irontec.repo
[irontec]
name=Irontec RPMs repository
baseurl=http://packages.irontec.com/centos/$releasever/$basearch/
rpm --import http://packages.irontec.com/public.key
yum install sngrep
2.命令行参数
Usage: sngrep [-hVcivNqrD] [-IO pcap_dump] [-d dev] [-l limit] [-B buffer] [-LH capture_url] [<match expression>] [<bpf filter>]
-h --help This usage
-V --version Version information
-d --device Use this capture device instead of default
-I --input Read captured data from pcap file
-O --output Write captured data to pcap file
-B --buffer Set pcap buffer size in MB (default: 2)
-c --calls Only display dialogs starting with INVITE
-r --rtp Capture RTP packets payload
-l --limit Set capture limit to N dialogs
-i --icase Make <match expression> case insensitive
-v --invert Invert <match expression>
-N --no-interface Don't display sngrep interface, just capture
-q --quiet Don't print captured dialogs in no interface mode
-D --dump-config Print active configuration settings and exit
-f --config Read configuration from file
-F --no-config Do not read configuration from default config file
-R --rotate Rotate calls when capture limit have been reached
-H --eep-send Homer sipcapture url (udp:X.X.X.X:XXXX)
-L --eep-listen Listen for encapsulated packets (udp:X.X.X.X:XXXX)
3.抓包效果
image.png
4. sngrep使用注意点
- 不要长时间用sngrep抓包，否则sgrep会占用非常多的内存。如果必须抓一段时间的包，务必使用tcpdump。
- 某些情况下，sngrep会丢包
- 某些情况下，sngrep会什么包都抓包不到，注意此时很可能要使用-d去指定抓包的网卡
