Live signalling capture by tbsigtrace: Difference between revisions

Latest revision as of 14:16, 7 March 2023

This article applies to:	Product	Version
This article applies to:	Tmedia	2.7, 2.8, 2.9, 2.10, 3.0, 3.2

You activate tbsigtrace and pipe it directly in Wireshark through SSH to get a live capture of SS7, ISDN, SIP, Sigtran and H.248 (not all in the same wireshark window). This page provides the procedure for a Windows base operating system using plink and Wireshark tools.

WARNING: tbsigtrace application should not be used all the time, otherwise it might reduce performance. Also we suggest to do the live capture on only one Tmedia at a time.

The procedure is as following:

Download plink

Download 64 bit plink at https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe
Download 32 bit plink at https://the.earth.li/~sgtatham/putty/latest/w32/plink.exe
Place it in C:\Program Files\Putty directory

Execute the command to capture the signalling accordingly

This is the structure of the command:

plink.exe -batch -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] "tbsigtrace -stdout -[protocol]" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For SS7 capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ss7" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For ISDN capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -isdn" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For SIP or SIGTRAN capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ip" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For H.248 capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -h248" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

For Radius or SNMP capture

plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tcpdump -i mgmt0 -s 0 -w - -f 'not tcp port 22'" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -

Link to Signaling Trace Capture Tool page: tbsigtrace

@@ Line 1: / Line 1: @@
-You can now activate tbsigtrace and pipe it directly in wireshark through SSH to get a live capture SS7, ISDN or IP (not all in the same wireshark window).
+{{DISPLAYTITLE:Live Signaling Capture with tbsigtrace}}
-'''WARNING: tbsigtrace application should not be used all the time, otherwise it might reduce performance and fill completely your hard drive. Also we suggest to do the live capture on only one Tmedia at a time'''.
+{| class="wikitable"
+|-
+|rowspan="2"|This article applies to:
+|'''Product'''
+|'''Version'''
+|-
+|Tmedia
+|2.7, 2.8, 2.9, 2.10, 3.0, 3.2
+|}
+You activate tbsigtrace and pipe it directly in Wireshark through SSH to get a live capture of SS7, ISDN, SIP, Sigtran and H.248 (not all in the same wireshark window). This page provides the procedure for a Windows base operating system using plink and Wireshark tools.
+'''WARNING: tbsigtrace application should not be used all the time, otherwise it might reduce performance. Also we suggest to do the live capture on only one Tmedia at a time'''.
 The procedure is as following:
 ==== Download plink  ====
+Download 64 bit plink at https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe <br>
+Download 32 bit plink at https://the.earth.li/~sgtatham/putty/latest/w32/plink.exe <br>
+Place it in  '''C:\Program Files\Putty''' directory
-   Download plink - http://the.earth.li/~sgtatham/putty/latest/x86/plink.exe
+=== Execute the command to capture the signalling accordingly  ===
-   Place it in  C:\Program Files\Putty directory
+This is the structure of the command:
+ plink.exe -batch -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] "tbsigtrace -stdout -[protocol]" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-==== Download tbsigtrace version 2.7  ====
-If not using version 2.7, download the attached tbsigtrace on unit (/root directory or any other valid directory)
-{| cellpadding="5" border="1" class="wikitable"
-|-
-! width="200" style="background: rgb(239, 239, 239) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" |CentOS version
-! width="200" style="background: rgb(239, 239, 239) none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;" |ppc version
-|-
-| valign="top" |
-*[[Media:tbsigtrace_2_7_10_centos.rar|tbsigtrace_2_7_10_centos ]]
-| valign="top" |
-*[[Media:tbsigtrace_2_7_10_ppc.rar|tbsigtrace_2_7_10_ppc]]
-|}
-'''Note:''' Unzip the file so that it gives you the executable file tbsigtrace_2_7_10_centos or tbsigtrace_2_7_10_ppc.
-==== Upload tbsigtrace to toolpack server  ====
-Rename tbsigtrace_2_7_10_centos or tbsigtrace_2_7_10_ppc to "tbsigtrace_2_7_10" and upload it to the toolpack server /root directory or any other valid directory.
-==== Execute the command to capture the signalling accordingly  ====
-For SS7 capture
+===== For SS7 capture =====
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] [dir]/tbsigtrace_2_7_10 -adapter TB00xxxx -stdout -ss7 | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ss7" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-  ex.
-  plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword /root/tbsigtrace_2_7_10 -adapter TB005052 -stdout -ss7 | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-For ISDN capture
+===== For ISDN capture =====
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] [dir]/tbsigtrace_2_7_10 -adapter TB00xxxx -stdout -isdn | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -isdn" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-  ex.
+===== For SIP or SIGTRAN capture =====
-  plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword /root/tbsigtrace_2_7_10 -adapter TB005052 -stdout -isdn | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -ip" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-For SIP or SIGTRAN capture
+===== For H.248 capture =====
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] [dir]/tbsigtrace_2_7_10 -adapter TB00xxxx -stdout -ip | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tbsigtrace -stdout -h248" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-  ex.
-  plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword /root/tbsigtrace_2_7_10 -adapter TB005052 -stdout -ip | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-For Radius, SNMP or H.248 capture
+===== For Radius or SNMP capture =====
-  plink.exe -ssh root@[IP_of_management_port] -P [ssh_port] -pw [ssh_password] tcpdump -i mgmt0 -s 0 -w - | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+ plink.exe -batch -ssh root@10.10.10.10 -pw mypassword "tcpdump -i mgmt0 -s 0 -w - -f 'not tcp port 22'" | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
-  ex.
+<br>
-  plink.exe -ssh root@10.10.10.10 -P 22 -pw mypassword tcpdump -i mgmt0 -s 0 -w - | "C:\Program Files\Wireshark\wireshark.exe" -k -i -
+Link to [[Toolpack Debug Application:Tbsigtrace|Signaling Trace Capture Tool]] page: [[Toolpack Debug Application:Tbsigtrace|tbsigtrace]]