Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options

tshark RTCP capture via PERL

by FirtyFree (Initiate)
on Nov 08, 2011 at 10:48 UTC ( #936735=perlquestion: print w/replies, xml ) Need Help??
FirtyFree has asked for the wisdom of the Perl Monks concerning the following question:

Hi all

Hope everyone here is well :-)

I was hoping someone could give me there expert opinion on the following:

I have a tshark capture setup that will filter RTCP packets and output only the fields that I am interested in specifically "jitter, cumulative packet loss, src host ip, sdes text etc" I want to capture this in a Perl script and write each row of stdout to MySQL.

To cut down on resource utilisation I've added a filter to the tshark capture that means I only list data where the cumulative packet loss is over a specific threshold.

This is how I planned to capture the tshark data and write into MySQL (for example):

tshark -i eth2 -o "rtp.heuristic_rtp: TRUE" -R 'rtcp.ssrc.cum_nr >= 50' -V -d udp.port==5005,rtcp -e rtcp.ssrc.fraction -e rtcp.ssrc.jitter -e rtcp.ssrc.cum_nr -e ip.src_host -e rtcp.sdes.text -S -T fields -E separator=, -E quote=d | perl ./

Essentially I was going to write the data row by row using the following method:

while (<STDIN>) { chomp;@qos = split(',',$_); INSERT DATA INTO MYSQL...... }

Is there a better cleaner way to do this without spamming stdin? can I control tshark completely inside Perl?

I'm quite new to Perl so if you guys could point me in the right direction that would be awesome - the MYSQL part I am comfortable with as I have several scripts that read // write to MySQL DB's.


Replies are listed 'Best First'.
Re: tshark RTCP capture via PERL
by jettero (Monsignor) on Nov 08, 2011 at 11:43 UTC

    Tshark, wireshark, and tcpdump are all the same thing. They use libpcap to capture network data and dump it to files. The main difference is that tshark and wireshark have all kinds of slick decoders built right in.

    For realtime captures and things, choose Net::Pcap::Easy. I wrote this module. Mostly people are turned of by the word Easy, and I can't blame them, but I think I've done a reasonable job making it easier for me to use. The main thing was to get all the information you need on one manpage.

    The real work is in Net::Pcap. It uses NetPacket to do decodes… I find it rather difficult to use in the raw, for one thing the truth values are backwards (like in C) and for another the documentation spans many man pages, but this is surely the more traditional way to do it. I'm also peripherally aware of a POE module that does event based pcaps.

    Anyway, I highly recommend you do this a little more natively, rather than trying to grok the random outputs of tshark. Those could change without any notice at all (even just moving from machine to machine) and then you'll have to go back and tweak your regexps and things.

      Hi Jettero

      Many thanks for responding, the main reason for using tshark, I guess is a lazy one, I can apply simple thresholds to the various rTCP fields that I am interested in to cut down the amount of traffic reported (I am not interested in capturing all traffic due to the volume) - the source of the rTCP data should be sending out senders reports every 5 secs so perhaps this is not an issue.

      I'll definately take a look at your suggestion as I would certainly like to control this natively as you suggested rather than via pipe, I was just a bit worried about the load produced when having to filter through all traffic manually, do you see any problems with this?

      TSHARK has failed me a little as I wanted to capture ALL SDES Item 'text' fields but unfortunately it only seems to return the last 'text' field using the 'rtcp.sdes.text' filter so I am hoping your method would give me the ability to return them all, that would be a big plus also for me

      Thanks again!

Re: tshark RTCP capture via PERL
by daniel_sinclair (Initiate) on Oct 11, 2012 at 14:03 UTC
    Good day, I find a good page, where you can find informations about the wireshark. The log capture are shown step by step. It is very helpful for me. There are other good informations too.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://936735]
Approved by marto
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others musing on the Monastery: (10)
As of 2018-06-19 15:15 GMT
Find Nodes?
    Voting Booth?
    Should cpanminus be part of the standard Perl release?

    Results (114 votes). Check out past polls.