fatal: unsupported interface type 12

[zoell]

I am running this in a docker container and just trying to get a report out from a pcap file which has only one sip session in it:

sipgrep -I a9875ab2-ca17-3335-22b3-0242ab110038.pcap -G
input: a9875ab2-ca17-3335-22b3-0242ab110038.pcap
filter: (ip) and ( portrange 5060-5061) or (udp and ip[6:2] & 0x3fff != 0)
fatal: unsupported interface type 12

Any idea on this error?

[adubovikov]

sorry, i didn't find the interface type 12 ... :-(

LINKTYPE_PPP = 9,
LINKTYPE_FDDI = 10,
LINKTYPE_PPP_HDLC = 50,

[zoell]

That is strange. Could be because of docker?

[adubovikov]

can you open the pcap file with wireshark and check the interface type ?

[zoell]

Yeah I just tried it but I cannot see the interface type. I created the pcap with pcapsipdump (to make sure every call is in a separate pcap) and it seems it only contains the SIP messages in it. And basically I just want to get the dialog details from it.

[adubovikov]

you can do same with sipgrep just provide a callid or from/to url

anyway, the interface is very strange, and once you opened it with wireshark, please go to network header and expand it, make screenshot and share it

[zoell]

Ok I just started like this:

sipgrep -d tun0 -g -G
interface: tun0 (10.8.0.0/255.255.254.0)
filter: (ip) and ( portrange 5060-5061) or (udp and ip[6:2] & 0x3fff != 0)
fatal: unsupported interface type 12

So it is basically the OpenVPN interface. Is that not supported?

[adubovikov]

looks like is not... need find offset and add it to the list of interfaces

[zoell]

Ok let's skip this for now, I will try to go with an other approach. So I can see that if I start sipgrep like this:

sipgrep -d any -g -G

It works because I can see the SIP messages even on tun0, and if I close the program with ctrl+x, the dialog messages are there. Is there any way to receive only the dialog messages so I can pipe them to an other software or something like that to process them?

[zoell]

And I think I was wrong, the tun0 calls are not visible it seems.

[adubovikov]

need known the offset and in this case you can see the payload of pcap

[zoell]

How can I get the offset?

And for my other question, do you know if I can pipe just the dialog messages to an other program?

[adubovikov]

this you can find in wireshark as well..
just dialog ? sorry, didn't get your question. What is your goal ?

[zoell]

Here it is:

Frame 1: 1241 bytes on wire (9928 bits), 1241 bytes captured (9928 bits)
    Encapsulation type: Raw IP (7)
    Arrival Time: Jun 12, 2017 14:41:07.619366000 GMT Summer Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1497274867.619366000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 1241 bytes (9928 bits)
    Capture Length: 1241 bytes (9928 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: raw:ip:udp:sip:sdp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Raw packet data
Internet Protocol Version 4, Src: 10.8.1.2, Dst: 10.8.1.7
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 1241
    Identification: 0xdeb6 (57014)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 63
    Protocol: UDP (17)
    Header checksum: 0x8349 [validation disabled]
    [Header checksum status: Unverified]
    Source: 10.8.1.2
    Destination: 10.8.1.7
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]

I just want to see the dialogs basically, I am not interested in other SIP messages. So whenever a dialog is completed, I want to send that dialog information to an other application (via pipe or anything like that) and process it.

[zoell]

Can you see anything useful in it?

[adubovikov]

if you can send a pcap to us, we will check it at first free slot...

[zoell]

You won't be able to see too much in it, it just contains the sip messages, nothing else, and this is what is in the frame data.