Live signalling capture by tbsigtrace: Difference between revisions

Latest revision as of 14:16, 7 March 2023

This article applies to:	Product	Version
This article applies to:	Tmedia	2.7, 2.8, 2.9, 2.10, 3.0, 3.2

You activate tbsigtrace and pipe it directly in Wireshark through SSH to get a live capture of SS7, ISDN, SIP, Sigtran and H.248 (not all in the same wireshark window). This page provides the procedure for a Windows base operating system using plink and Wireshark tools.

WARNING: tbsigtrace application should not be used all the time, otherwise it might reduce performance. Also we suggest to do the live capture on only one Tmedia at a time.

The procedure is as following:

Download plink

Download 64 bit plink at https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe
Download 32 bit plink at https://the.earth.li/~sgtatham/putty/latest/w32/plink.exe
Place it in C:\Program Files\Putty directory

Execute the command to capture the signalling accordingly

This is the structure of the command:

plink.exe -batch -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] "tbsigtrace -stdout -[protocol]" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For SS7 capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ss7" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For ISDN capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -isdn" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For SIP or SIGTRAN capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ip" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For H.248 capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -h248" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For Radius or SNMP capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tcpdump -i mgmt0 -s 0 -w - -f 'not tcp port 22'" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

Link to Signaling Trace Capture Tool page: tbsigtrace

@@ Line 1: / Line 1: @@
-You can now activate tbsigtrace and pipe it directly in wireshark through SSH to get a live capture SS7, ISDN or IP (not all in the same wireshark window).
+{{DISPLAYTITLE:Live Signaling Capture with tbsigtrace}}
-The procedure is as following:
+{| class="wikitable"
+|-
+|rowspan="2"|This article applies to:
+|'''Product'''
+|'''Version'''
+|-
+|Tmedia
+|2.7, 2.8, 2.9, 2.10, 3.0, 3.2
+|}
-==== Download plink  ====
+You activate tbsigtrace and pipe it directly in Wireshark through SSH to get a live capture of SS7, ISDN, SIP, Sigtran and H.248 (not all in the same wireshark window). This page provides the procedure for a Windows base operating system using plink and Wireshark tools.
-   Download plink - http://the.earth.li/~sgtatham/putty/latest/x86/plink.exe
+'''WARNING: tbsigtrace application should not be used all the time, otherwise it might reduce performance. Also we suggest to do the live capture on only one Tmedia at a time'''.
-   Place it in  C:\Program Files\Putty directory
-==== Download tbsigtrace version 2.7  ====
+The procedure is as following:
-If not using version 2.7, download the attached tbsigtrace on unit (/root directory or any other valid directory)
-{| cellpadding="5" border="1" class="wikitable"
+==== Download plink  ====
-|-
+Download 64 bit plink at https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe <br>
-! width="200" style="background: rgb(239, 239, 239) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" |CentOS version
+Download 32 bit plink at https://the.earth.li/~sgtatham/putty/latest/w32/plink.exe <br>
-! width="200" style="background: rgb(239, 239, 239) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" |ppc version
+Place it in  '''C:\Program Files\Putty''' directory
-|-
-| valign="top" |
-*[[Media:tbsigtrace_2_7_10_centos.rar|CentOS version ]]
-| valign="top" |
-*[[Media:tbsigtrace_2_7_10_ppc.rar|ppc version]]
-|}
-'''Note:''' Unzip the file so that it gives you the executable file tbsigtrace_2_7_10_centos or tbsigtrace_2_7_10_ppc.
-Rename it to "tbsigtrace_2_7_10" and upload it to the toolpack server /root directory or any other valid directory.
-==== Execute the command to capture the signalling accordingly  ====
+=== Execute the command to capture the signalling accordingly  ===
+This is the structure of the command:
+ plink.exe -batch -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] "tbsigtrace -stdout -[protocol]" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-For SS7 capbure
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] [dir]/tbsigtrace_2_7_10 -stdout -ss7 | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-ex.
+===== For SS7 capture =====
-plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword /root/tbsigtrace_2_7_10 -stdout -ss7 | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ss7" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-For ISDN capbure
+===== For ISDN capture =====
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] [dir]/tbsigtrace_2_7_10 -stdout -isdn | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -isdn" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-ex.
+===== For SIP or SIGTRAN capture =====
-plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword /root/tbsigtrace_2_7_10 -stdout -isdn | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ip" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-For SIP or SIGTRAN capbure
+===== For H.248 capture =====
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] [dir]/tbsigtrace_2_7_10 -stdout -ip | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -h248" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-ex.
+===== For Radius or SNMP capture =====
-plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword /root/tbsigtrace_2_7_10 -stdout -ip | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tcpdump -i mgmt0 -s 0 -w - -f 'not tcp port 22'" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+<br>
+Link to [[Toolpack Debug Application:Tbsigtrace|Signaling Trace Capture Tool]] page: [[Toolpack Debug Application:Tbsigtrace|tbsigtrace]]