Skip to main content

Convert StarOS "monitor subscriber" or "monitor protocol" ASCII dump to PCAP

Project description

mon2pcap

mon2pcap is a program for converting Cisco's StarOS "monitor subscriber" or "monitor protocol" text based packet captures to PCAP.
This program will work only if the PDU Hexdump switch (X or A) is enabled.

Disclaimer

This program comes with no guarantees whatsoever.
The hexdump in the monsub does NOT represent a full packet, hence:
⚠️ All data-link layer protocols are generated, the MACs there are bogus.
⚠️ All non-IP packets data-link, network and transport protocols are bogus.
⚠️ If it's IP packet, the ports are correct (most of the time) but the transport level protocol is bogus.
The layers had to be generated for wireshark and other tools working with pcap file formats to properly dissect them.

Installation

Prerequisites

Usage

$ mon2pcap --help
usage: mon2pcap [-h] -i <infile> [-o <outfile>]
                [-e {GTPC,GTPCv2,GTPU,RADIUS,USERL3,USERL3_IPV6,CSS,DIAMETER,RANAP...}]
                [-s] [-v] [-d]

Convert StarOS "monitor subscriber" or "monitor protocol" ASCII dump to PCAP

options:
  -h, --help            show this help message and exit
  -i <infile>, --input <infile>
                        input file
  -o <outfile>, --output <outfile>
                        output file
  -e {GTPC,GTPCv2,GTPU,RADIUS,USERL3,USERL3_IPV6,CSS,DIAMETER,RANAP...}
                        exclude one or more protocols
  -s, --skip-malformed  Skip malformed packets
  -v, --version         show program's version number and exit
  -d, --debug           debug level logging
$  mon2pcap -i test_mon_sub.txt
100%|██████████████████████████████████████████████████████| 1746/1746 [00:00<00:00, 237876.14 lines/s]
PCAP generated at "test_mon_sub.pcap"

Found #14 valid packets
========================
 GTPC         : 4
 DIAMETER     : 4
 PFCP         : 4
 GTPP         : 2
 Ignored      : 4

Implemented protocols

SPGW/GGSN/SAEGW:

  • GTPC (24) ON by default
  • EGTPC (74) ON by default
  • Radius Auth (13) ON by default
  • Radiu Acct (14) ON by default
  • EC Diameter (36) ON by default
  • GTPU (26) OFF by default
  • User L3 (19) OFF by default
  • CSS Data (34) OFF by default
  • IPSec IKEv2 (40) OFF by default
  • DNS Client (70) OFF by default
  • L2TP (21) ON by default
  • Radius COA (31) OFF by default
  • DHCP (28) OFF by default
  • L3 Tunnel (33) OFF by default //tested with GRE
  • PFCP (49) ON by default
  • GTPP (27) ON by default
  • LMISF (39) OFF by default

MME/SGSN:

  • GTPC (24) ON by default
  • S1AP (81) ON by default
  • DIAMETER (36) ON by default
  • RANAP (56) OFF by default
  • BSSGP (59) OFF by default
  • TCAP (54) OFF by default
  • SCCP (53) OFF by default
  • SLS (94) ON by default
  • SCTP (51) OFF by default

Changelog

CHANGELOG

License

GPLv3

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

mon2pcap-1.0.7.tar.gz (27.0 kB view details)

Uploaded Source

Built Distribution

mon2pcap-1.0.7-py3-none-any.whl (28.1 kB view details)

Uploaded Python 3

File details

Details for the file mon2pcap-1.0.7.tar.gz.

File metadata

  • Download URL: mon2pcap-1.0.7.tar.gz
  • Upload date:
  • Size: 27.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: poetry/1.6.1 CPython/3.11.5 Darwin/23.0.0

File hashes

Hashes for mon2pcap-1.0.7.tar.gz
Algorithm Hash digest
SHA256 0cb58ebbb94c905ebe4f1a69729164bb3ba3f03e9d1e969fbf093559d46de412
MD5 d872621df1a69187153aa764aeaca570
BLAKE2b-256 3a5193f5ed7efb58ad6f483ba95c7864bdd6dc705816090386dc07a03873b6d9

See more details on using hashes here.

File details

Details for the file mon2pcap-1.0.7-py3-none-any.whl.

File metadata

  • Download URL: mon2pcap-1.0.7-py3-none-any.whl
  • Upload date:
  • Size: 28.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: poetry/1.6.1 CPython/3.11.5 Darwin/23.0.0

File hashes

Hashes for mon2pcap-1.0.7-py3-none-any.whl
Algorithm Hash digest
SHA256 19624fe45f91574448e71cc4aee344e3b2795f6d89d4847207b4988d5478a222
MD5 f5110410da0122804b2f858e8e15afbe
BLAKE2b-256 cee71ad7689be352d570646cffd3c1a58566b73ef9b92d9560023af3d5ceaf7e

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page