Tshark Scripts - Revision history

Busk at 15:51, 9 February 2022

2022-02-09T15:51:58Z

Busk at 15:47, 9 February 2022

2022-02-09T15:47:02Z

Busk at 15:22, 9 February 2022

2022-02-09T15:22:20Z

Busk at 14:49, 9 February 2022

2022-02-09T14:49:14Z

Busk at 23:45, 8 February 2022

2022-02-08T23:45:52Z

Busk at 23:42, 8 February 2022

2022-02-08T23:42:45Z

Busk at 23:32, 8 February 2022

2022-02-08T23:32:54Z

Busk at 23:29, 8 February 2022

2022-02-08T23:29:13Z

Busk at 23:14, 8 February 2022

2022-02-08T23:14:10Z

Busk: Created page with "Collect SNIs without using up a lot of memory ``` #!/bin/bash set -eu duration=180 interface=internal # pmatch=python pmatch=tshark get_sni() { ts=$(date +"%Y-%m-%dT%T.%3N%..."

2022-02-08T23:12:24Z

Created page with "Collect SNIs without using up a lot of memory ``` #!/bin/bash set -eu duration=180 interface=internal # pmatch=python pmatch=tshark get_sni() { ts=$(date +"%Y-%m-%dT%T.%3N%..."

New page

Collect SNIs without using up a lot of memory
```
#!/bin/bash
set -eu
duration=180
interface=internal
# pmatch=python
pmatch=tshark
get_sni() {

ts=$(date +"%Y-%m-%dT%T.%3N%z")
echo "I: Running tshark instance to get sni info. ${ts}"
sleep 1
tshark -l -i $interface -a duration:$duration -f 'dst port ( 443 )' -Y 'ssl.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e ssl.handshake.extensions_server_name 2>&1 > sni.log &
}

is_tshark_running() {
echo foo
}

main() {
echo Staring tshark looper
while true; do
if ! pgrep -x "$pmatch" > /dev/null; then
get_sni
else
echo "$pmatch command is already running."
fi
sleep 5
done
}

main
```

Watch memory usage of tshark command
```
top | grep tshark
```

@@ Line 50: / Line 50: @@
 ```
-nohup get-snis.sh &
+nohup ./get-snis.sh &
 ```

@@ Line 7: / Line 7: @@
 sleep=5
 duration=90
-interface=F5_internal
+interface=internal
 pmatch=tshark
-snimatch=exchange-solutions.tech
+snimatch=example.com
 get_sni() {
@@ Line 17: / Line 18: @@
    # tshark -l -i $interface -a duration:$duration -f 'dst port ( 443 )' -Y 'ssl.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e ssl.handshake.extensions_server_name 2>&1 >> sni.log  &
    tshark -l -i $interface -a duration:$duration -f 'dst port ( 443 )' -Y 'ssl.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e ssl.handshake.extensions_server_name | grep $snimatch 2>&1 >> sni.log  &
+}
@@ Line 24: / Line 32: @@
 main() {
    start_ts=$(date +"%Y-%m-%dT%T.%3N%z")
    echo "I: Starting tshark looper for interfarce: $interface and SNImatch: $snimatch at $start_ts"
@@ Line 30: / Line 39: @@
        get_sni
      else
-       echo "$pmatch command is already running."
+       # echo "$pmatch command is already running."
      fi
-     sleep $sleep
+     sleep $sleep_secs
    done
+}

@@ Line 5: / Line 5: @@
 #!/bin/bash
 set -eu
 duration=90
-interface=internal
+interface=F5_internal
 pmatch=tshark
-snimatch=example.com
+snimatch=exchange-solutions.tech
 get_sni() {
    ts=$(date +"%Y-%m-%dT%T.%3N%z")
-   echo "I: Running tshark instance to get sni info. ${ts}"
+   # echo "I: Running tshark instance to get sni info. ${ts}"
-   sleep 1
+   # sleep 1
    # tshark -l -i $interface -a duration:$duration -f 'dst port ( 443 )' -Y 'ssl.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e ssl.handshake.extensions_server_name 2>&1 >> sni.log  &
    tshark -l -i $interface -a duration:$duration -f 'dst port ( 443 )' -Y 'ssl.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e ssl.handshake.extensions_server_name | grep $snimatch 2>&1 >> sni.log  &
@@ Line 24: / Line 24: @@
 main() {
-   echo Staring tshark looper
+  start_ts=$(date +"%Y-%m-%dT%T.%3N%z")
    while true; do
      if ! pgrep -x "$pmatch" > /dev/null; then
@@ Line 31: / Line 32: @@
        echo "$pmatch command is already running."
      fi
-     sleep 5
+     sleep $sleep
    done
+}

← Older revision		Revision as of 23:42, 8 February 2022
Line 34:		Line 34:

	main		main
		+	```
		+
		+	```
		+	nohup get-snis.sh &
	```		```

@@ Line 39: / Line 39: @@
 ```
 top | grep tshark
 ```

@@ Line 1: / Line 1: @@
 Collect SNIs without using up a lot of memory
 ```
 #!/bin/bash