1717 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
1818 *
1919
20- Requirements:
21-
22- npm install cap
23- npm install sipcore
24- npm install hep-js
25- npm install elasticsearch
26-
27-
2820 Example Usage:
2921
3022 HEP3:
3123 nodejs captagent.js -debug true -s 127.0.0.1 -p 9063 -i 2001
32- ES:
33- nodejs captagent.js -debug true -ES 'https://test.facetflow.io:443' -t 15
3424
3525 Daemonize using forever:
3626
3929
4030*/
4131
42- var version = 'v0.3 ' ;
32+ var version = 'v0.4 ' ;
4333var debug = false ;
4434var sipdebug = false ;
4535var stats = { rcvd : 0 , parsed : 0 , hepsent : 0 , err : 0 , heperr : 0 } ;
@@ -57,13 +47,6 @@ if(process.argv.indexOf("-h") != -1){
5747 console . log ( ' -i: HEP3 Agent ID' ) ;
5848 console . log ( ' -P: HEP3 Password' ) ;
5949 console . log ( ) ;
60- console . log ( ' -ES: ES _Bulk API IP (ie: 127.0.0.1) ' ) ;
61- console . log ( ' -EP: ES _Bulk API Port (ie: 443) ' ) ;
62- console . log ( ' -EI: ES _Bulk API Index (ie: captagent)' ) ;
63- console . log ( ' -ET: ES _Bulk API Type (ie: captagent)' ) ;
64- console . log ( ' -EU: ES _Bulk API Auth (ie: user:pass)' ) ;
65- console . log ( ' -t: ES _Bulk Frequency (in seconds)' ) ;
66- console . log ( ) ;
6750 console . log ( ' -debug: Debug Internals (ie: -debug true)' ) ;
6851 console . log ( ' CRTL-C: Exit' ) ;
6952 console . log ( ) ;
@@ -81,7 +64,6 @@ if(process.argv.indexOf("-h") != -1){
8164 if ( process . argv . indexOf ( "-debug" ) != - 1 ) {
8265 debug = process . argv [ process . argv . indexOf ( "-debug" ) + 1 ] ;
8366 }
84-
8567 // HEP ARGS & DEFAULTS
8668 var hep_server = 'localhost' ;
8769 if ( process . argv . indexOf ( "-s" ) != - 1 ) {
@@ -100,99 +82,29 @@ if(process.argv.indexOf("-h") != -1){
10082 hep_pass = process . argv [ process . argv . indexOf ( "-P" ) + 1 ] ;
10183 }
10284
103- // ES ARGS & DEFAULTS (experimental, HTTPS default)
104- var es_on = false ;
105- var es_url = 'http://127.0.0.1:9200' ;
106- var es_user = '' ;
107-
108- if ( process . argv . indexOf ( "-ES" ) != - 1 ) {
109- es_url = process . argv [ process . argv . indexOf ( "-ES" ) + 1 ] ;
110- es_on = true ;
111- }
112-
113- var es_index = 'captagent' ;
114- if ( process . argv . indexOf ( "-EI" ) != - 1 ) {
115- es_index = process . argv [ process . argv . indexOf ( "-EI" ) + 1 ] ;
116- }
117- var es_type = 'captagent' ;
118- if ( process . argv . indexOf ( "-ET" ) != - 1 ) {
119- es_type = process . argv [ process . argv . indexOf ( "-ET" ) + 1 ] ;
120- }
121-
122- if ( process . argv . indexOf ( "-EU" ) != - 1 ) {
123- es_user = process . argv [ process . argv . indexOf ( "-EU" ) + 1 ] ;
124- }
125-
126- var es_timeout = 30 ;
127- if ( process . argv . indexOf ( "-t" ) != - 1 ) {
128- es_timeout = parseInt ( process . argv [ process . argv . indexOf ( "-t" ) + 1 ] ) ;
129- }
130-
131- var es_interval = es_timeout * 1000 ;
132- // var es_buffer;
133-
134-
13585console . log ( 'Starting JSAgent ' + version ) ;
13686
13787/* NODE.JS Requirements */
138-
139- var SIP = require ( 'sipcore' ) ;
140- var Cap = require ( 'cap' ) . Cap ,
88+ var SIP = require ( 'sipcore' ) ,
89+ Cap = require ( 'cap' ) . Cap ,
14190 decoders = require ( 'cap' ) . decoders ,
142- PROTOCOL = decoders . PROTOCOL ;
143-
144- var HEPjs = require ( 'hep-js' ) ;
145-
146- /* ELASTICSEARCH Configuration */
147- if ( es_on ) {
148- var elasticsearch = require ( 'elasticsearch' ) ;
149- if ( es_user . length > 1 ) { es_url = es_url . replace ( '://' , '://' + es_user + '@' ) ; }
150-
151- var client = new elasticsearch . Client ( {
152- hosts : [
153- es_url
154- ]
155- } ) ;
156- }
157-
91+ PROTOCOL = decoders . PROTOCOL ,
92+ HEPjs = require ( 'hep-js' ) ;
15893
15994/* HEP OUT SOCKET */
160-
161- var dgram = require ( 'dgram' ) ;
162- var socket = dgram . createSocket ( "udp4" ) ;
163-
164-
95+ var dgram = require ( 'dgram' ) ,
96+ socket = dgram . createSocket ( "udp4" ) ;
16597
16698/* CAPTURE SOCKET */
167-
16899var c = new Cap ( ) ,
169100 device = Cap . findDevice ( ) ,
170- // filter = 'port 5060',
171101 filter = bpf_filter ,
172102 bufSize = 10 * 1024 * 1024 ,
173103 buffer = new Buffer ( 65535 ) ;
174104
175-
176- /* HTTP SOCKET */
177- if ( es_on ) {
178- var es_buffer = '' ;
179- setInterval ( function ( ) {
180- if ( debug ) console . log ( "HTTP: Sending Statistics..." ) ;
181- if ( buffer . length > 1 ) {
182- // Send buffer and clear
183- sendHTTP ( es_buffer + '\n' ) ;
184- es_buffer = '' ;
185- }
186- } , es_interval ) ;
187- }
188-
189-
190-
191105/* APP START */
192-
193106console . log ( 'Capturing from device ' + device + ' with BPF (' + bpf_filter + ')' ) ;
194107console . log ( 'Sending HEP3 Packets to ' + hep_server + ':' + hep_port + ' with id ' + hep_id ) ;
195- if ( es_on ) console . log ( 'Sending JSON Packets to ' + es_url + ' _Bulk API with type ' + es_type ) ;
196108
197109var linkType = c . open ( device , filter , bufSize , buffer ) ;
198110
@@ -206,7 +118,6 @@ c.on('packet', function(nbytes, trunc) {
206118 var hep_proto = { "type" : "HEP" , "version" : 3 , "payload_type" : "SIP" , "captureId" : hep_id , "capturePass" : hep_pass , "ip_family" : 2 } ;
207119
208120 // raw packet data === buffer.slice(0, nbytes)
209-
210121 if ( linkType === 'ETHERNET' ) {
211122 var ret = decoders . Ethernet ( buffer ) ;
212123
@@ -281,22 +192,8 @@ var parseSIP = function(msg, rcinfo){
281192 if ( sipdebug ) console . log ( sipmsg ) ;
282193 if ( debug ) console . log ( 'CSeq: ' + sipmsg . headers . cseq ) ;
283194 stats . parsed ++ ;
284- // SEND HEP3 Packet
285- sendHEP3 ( sipmsg , msg , rcinfo ) ;
286-
287- if ( es_on ) {
288- // PARSE USERS/URI for Elasticsearch Indexing
289- sipmsg . headers [ "from_uri" ] = sipmsg . headers . from . match ( / ^ ( < s i p ) ( .* ) > / ) [ 0 ] ;
290- sipmsg . headers [ "to_uri" ] = sipmsg . headers . to . match ( / ^ ( < s i p ) ( .* ) > / ) [ 0 ] ;
291- sipmsg . headers [ "from_user" ] = sipmsg . headers . from . match ( / < s i p : ( .* ?) @ / ) [ 1 ] ;
292- sipmsg . headers [ "to_user" ] = sipmsg . headers . to . match ( / < s i p : ( .* ?) @ / ) [ 1 ] ;
293- // SESSION METHOD
294- sipmsg . headers [ "sess_method" ] = sipmsg . headers . cseq . replace ( / [ ^ A - Z a - z \s ! ? ] / g, '' ) ;
295- // INJECT NETWORK/HEP Headers
296- sipmsg [ 'hep' ] = rcinfo ;
297-
298- bufferSIP ( sipmsg ) ;
299- }
195+ // SEND HEP3 Packet
196+ sendHEP3 ( sipmsg , msg , rcinfo ) ;
300197 }
301198 catch ( e ) {
302199 if ( debug ) console . log ( e ) ;
@@ -307,7 +204,6 @@ var parseSIP = function(msg, rcinfo){
307204
308205
309206/* HEP3 Socket OUT */
310-
311207var sendHEP3 = function ( sipmsg , msg , rcinfo ) {
312208 if ( sipmsg ) {
313209 try {
@@ -331,42 +227,6 @@ var sendHEP3 = function(sipmsg,msg, rcinfo){
331227}
332228
333229
334-
335- /* JSON _Bulk Buffer */
336-
337- var bufferSIP = function ( data ) {
338- if ( debug ) console . log ( 'Buffering SIP....' ) ;
339- var now = new Date ( ) . toISOString ( ) . substring ( 0 , 10 ) . replace ( / - / g, '.' ) ;
340- data [ "@timestamp" ] = new Date ( ) . toISOString ( ) . slice ( 0 , 19 ) + 'Z' ;
341- es_buffer += '{"index":{"_index":"' + es_index + '-' + now + '","_type":"' + es_type + '"}}\n' + JSON . stringify ( data ) + '\n' ;
342- }
343-
344-
345-
346- /* HTTP Socket OUT */
347-
348- var sendHTTP = function ( xbuffer ) {
349- if ( xbuffer && xbuffer . length > 1 ) {
350- try {
351- if ( debug ) console . log ( 'Sending HTTP JSON Packet...' ) ;
352- // post the data to Bulk using ES Client
353- client . bulk ( {
354- body : xbuffer
355- } , function ( err , resp ) {
356- if ( err ) console . log ( 'Err: ' , JSON . stringify ( err ) ) ;
357- else if ( debug ) console . log ( 'Resp: ' , JSON . stringify ( resp ) ) ;
358- } ) ;
359-
360- }
361- catch ( e ) {
362- console . log ( 'HTTP Error sending!' ) ;
363- console . log ( e ) ;
364- stats . heperr ++ ;
365- }
366- }
367- }
368-
369-
370230/* UDP Socket Handler */
371231
372232var getSocket = function ( type ) {
0 commit comments