Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 118 lines (89 sloc) 4 KB
#!/bin/bash
# unterminated-connections.sh begins on the previous line
#
# This macro uses tshark to find TCP connections aka streams in a packet
# trace that have not been terminated by the end of the packet trace.
#
# The output is a list of stream indexes and a count of the total number of
# streams.
#
# Version 1.0 March 5, 2017
# Version 1.1 April 1, 2017
# Added copyright and GNU GPL statement and disclaimer
UNTERMINATEDCONNECTSIONVERSION="1.1_2017-04-01"
# from https://github.com/noahdavids/packet-analysis.git
# Copyright (C) 2017 Noah Davids
# This program is free software: you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the Free
# Software Foundation, version 3, https://www.gnu.org/licenses/gpl-3.0.html
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
if [ $# -ne 1 ] && [ $# -ne 2 ]
then echo "Usage:"
echo " unterminated-connections.sh FILE TSHARK-FILTER"
echo " FILE is the name of the trace file to be analyzed"
echo " TSHARK-FILTER is an optional filter to limit the packets"
echo " and connections to be considered"
echo "Example:"
echo " unterminated-connections.sh trace.pcap"
echo " unterminated-connections.sh trace.pcap \"tcp.port == 1234\" "
exit
fi
FILE=$1
if [ ! -e $FILE ]
then echo "Could not find input file $FILE"
exit
fi
# I always echo the command and arguments to STDOUT as a sanity check
echo unterminated-connections.sh $FILE $2
# Figure out if we can use "-Y" as the display filter argument or we need
# "-R". Basically look at the help output and if we do not find the "-Y"
# we use "-R"
DASH="-Y"
if [ $(tshark -help | egrep "\-Y <display filter>" | wc -l) -eq 0 ]
then DASH="-R"
fi
# Scan the packet capture file and for any TCP packets output the TCP stream
# index and the value if the TCP FIN and TCP RESET flags. Then sort removing
# the duplicates. Writethe list to a temporary file in /tmp.
if [ $# -eq 1 ]
then
tshark -r $FILE $DASH "tcp.stream" -T fields -e tcp.stream \
-e tcp.flags.fin -e tcp.flags.reset | sort -u \
> /tmp/unterminated-connections-1
fi
# If a filter argument was provided add it to the display filter.
if [ $# -eq 2 ]
then
FILTER=$2
tshark -r $FILE $DASH "tcp.stream && $FILTER" -T fields -e tcp.stream \
-e tcp.flags.fin -e tcp.flags.reset | sort -u \
> /tmp/unterminated-connections-1
fi
# Scan the first temporay file and create a new file. Add a dash (-) at the
# end of the TCP stream index and an "F:" and "R:" in front of the FIN and
# reset flags. The dash is needed so that when we search for the index we
# do not get lines where the index is a prefix, i.e. search for 100 and get
# 1000 thru 1009 as well.
cat /tmp/unterminated-connections-1 | awk '{print $1 "- F:" $2 " R:" $3}' \
> /tmp/unterminated-connections-2
# Extract out just the unique TCP stream indexes and then for each index
# search the file for lines with that stream index. Combine all the lines
# by changing new lines to spaces and then filter out anything with "F:1" or
# "R:1". Then print the TCP stream index to a third temporary file.
for x in $(cat /tmp/unterminated-connections-2 | awk '{print $1}' \
| tr "-" " " | sort -nu)
do grep ^$x- /tmp/unterminated-connections-2 | tr "\n-" " " \
| grep -v "R:1" | grep -v "F:1" | awk '{print $1}'
done > /tmp/unterminated-connections-3
# Display the temorary file to the terminal window, then count the lines in the
# file and display that as well
cat /tmp/unterminated-connections-3
echo Total number of unterminated connectionsis $(cat /tmp/unterminated-connections-3 | wc -l)
# clean up the temporary files
rm /tmp/unterminated-connections-1
rm /tmp/unterminated-connections-2
rm /tmp/unterminated-connections-3
# unterminated-connections.sh stops here